Description
Red Hat CNA-LR concluded that this CVE is not valid.
Published: 2026-08-05
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Red Hat CNA-LR concluded that this CVE is not valid.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the newest Mautic release that removes the unvalidated field handling.
  • If an upgrade cannot be performed immediately, limit access to the vulnerable AJAX endpoint so that only authorized administrators can call it, or completely disable the action for non‑privileged users.
  • Implement server‑side validation to ensure that the "field" parameter matches an allowed column name before it is used in the query string.

Generated by OpenCVE AI on August 10, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References

No reference.

History

Mon, 17 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Title Mautic - SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter. Red Hat CNA-LR concluded that this CVE is not valid.

Mon, 10 Aug 2026 12:00:00 +0000

Type Values Removed Values Added
Description Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks. Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter.

Mon, 10 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint Mautic - SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint

Wed, 05 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 05 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Mautic
Mautic mautic
Vendors & Products Mautic
Mautic mautic

Wed, 05 Aug 2026 11:15:00 +0000

Type Values Removed Values Added
Description Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks.
Title Mautic: SQL Injection via field Parameter in Lead-by-Field-Value AJAX Endpoint
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Mautic Mautic
cve-icon MITRE

Status: REJECTED

Assigner: TuranSec

Published:

Updated: 2026-08-17T13:59:29.024Z

Reserved: 2026-08-05T10:53:53.176Z

Link: CVE-2026-71245

cve-icon Vulnrichment

Updated:

cve-icon NVD

Status : Rejected

Published: 2026-08-05T11:16:27.487

Modified: 2026-08-17T14:20:21.933

Link: CVE-2026-71245

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T23:00:07Z

Weaknesses

No weakness.