An authenticated attacker can supply arbitrary URLs to the Focus component of Mautic, causing the server to initiate outbound HTTP requests. This Server‑Side Request Forgery allows internal network reconnaissance or access to internal services that are normally isolated from the internet. The vulnerability is a classic example of insufficient input validation, classified as CWE‑918 and presenting a moderate risk to confidentiality and integrity.

The flaw affects the Mautic open‑source marketing automation platform, specifically its Focus component. The CVE entry does not list specific versions, so any installation of Mautic that includes the Focus feature and has not applied vendor fixes may be susceptible.

The CVSS score of 6.4 indicates a moderate severity level. No EPSS value is reported, and the vulnerability is not listed in the CISA KEV catalog. Because the user must be authenticated to exploit the flaw and the description shows no direct network discovery from the outside, the likely attack vector is internal or through compromised credentials. Still, the potential to exfiltrate data or pivot to other internal systems elevates the importance of timely mitigation.