CVE-2026-115196: Mautic open redirect in form submission endpoint

CVE-2026-115196 · Severity: medium · CVSS 5.4 · Published 2026-10-26

Mautic is a marketing automation platform that allows organizations to create and publish web forms to capture visitor data. An unverified redirect vulnerability in the form submission endpoint allows attackers to trick users into visiting malicious websites by crafting specially prepared forms, potentially enabling phishing attacks or malware delivery. The vulnerability requires no authentication and affects any Mautic instance with published forms.

Technologies: Mautic. Vendors: Mautic.

Quick answers

Is CVE-2026-115196 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115196 being exploited in the wild.
How severe is CVE-2026-115196?
Medium severity, with a CVSS score of 5.4, published 26 October 2026.
Which products and versions are affected?
Mautic 1.0.0-beta to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1.
Is there a fix for CVE-2026-115196?
Yes: fixed in 5.2.12, 6.0.10, 7.2.2. Until then: Configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own trusted websites. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115196 attacked?
It is attacked over the network.
Am I affected by CVE-2026-115196?
Check whether you run Mautic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 5.2.12, 6.0.10, 7.2.2

Configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own trusted websites.

Technical details

An open redirect vulnerability exists in Mautic's /form/submit endpoint where user-supplied return URL parameters are not validated before being used in HTTP redirects. An unauthenticated attacker can craft a malicious form that, upon submission, redirects victims to arbitrary external hosts. The attack requires victim interaction (form submission) but succeeds over the network from any location.

Affected products

  • Mautic Mautic 1.0.0-beta to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1

Timeline

  • 2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.