CVE-2026-115191: Mautic SQL injection in contact lookup AJAX endpoint

CVE-2026-115191 · Severity: high · CVSS 7.1 · Published 2026-10-26

Mautic is a marketing automation platform used by organizations to manage campaigns and customer contacts. A SQL injection flaw in the contact lookup feature allows any authenticated user—regardless of their account permissions—to execute arbitrary database queries and steal sensitive data including user credentials, contact information, and campaign content. This exposes the entire Mautic database to unauthorized access by a low-privilege insider.

Technologies: Mautic. Vendors: Mautic.

Quick answers

Is CVE-2026-115191 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115191 being exploited in the wild.
How severe is CVE-2026-115191?
High severity, with a CVSS score of 7.1, published 26 October 2026.
Which products and versions are affected?
Mautic 2.1.0 through 5.2.11, 6.0.0 through 6.0.9, 7.0.0 through 7.2.1.
Is there a fix for CVE-2026-115191?
Yes: fixed in 5.2.12, 6.0.10, 7.2.2. Until then: Limit Mautic user accounts to trusted users, deactivate unused accounts, and enforce strong passwords. Block requests to /s/ajax with the action lead:getLeadIdsByFieldValue at the web server or web application firewall level.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115191 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-115191?
Check whether you run Mautic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 5.2.12, 6.0.10, 7.2.2

Limit Mautic user accounts to trusted users, deactivate unused accounts, and enforce strong passwords. Block requests to /s/ajax with the action lead:getLeadIdsByFieldValue at the web server or web application firewall level.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-26"}]

Technical details

The /s/ajax endpoint accepts an unvalidated request parameter used to select which contact field to search; this parameter is passed directly into a SQL query without sanitization, enabling blind SQL injection attacks. An attacker with any valid Mautic user account (authentication required, no network bypass) can extract arbitrary data from the Mautic database using boolean-based or time-based blind techniques. The vulnerability affects Mautic 2.1.0 through 7.x with fixes in 5.2.12, 6.0.10, and 7.2.2.

Affected products

  • Mautic Mautic 2.1.0 through 5.2.11, 6.0.0 through 6.0.9, 7.0.0 through 7.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.