An authorization bypass flaw exists in the Mautic 7 API v2 endpoints that use API Platform. Roles with owner‑scope restrictions (for example, viewown or editown) are not enforced correctly, allowing an authenticated user with low privileges to access or modify resources owned by other users. This vulnerability is a typical privilege escalation through improper permission checks (CWE‑863) and can compromise the confidentiality, integrity, or availability of user data in the system.

The vulnerability affects installations of Mautic version 7 that expose the API v2 endpoints. Any deployment that has API Platform enabled and assigns owner‑scope roles is potentially impacted. No other product versions or vendors are listed.

The CVSS score of 7.1 classifies the issue as high severity, although its EPSS score is not available and it is not listed in the CISA KEV catalog. Attackers need to be authenticated to the API, so the attack vector is remote and relies on compromised or legitimate API credentials. Once authenticated, a user can bypass ownership logic and read or alter data belonging to other users. Because proper authorization checks are missing, exploitation is straightforward without code execution or buffer overflow.