CVEvulnerability

CVE-2026-4776

7.1 HIGH Published 2026-05-29 Modified 2026-07-21 Official page ↗
Status
Deferred
Published
2026-05-29
Last modified
2026-07-21
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Weaknesses
CWE-89

Description

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Related

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References