# CVE-2026-115196: Mautic open redirect in form submission endpoint

Source: https://junglewise.ai/threats/cve-2026-115196-an-open-redirect-vulnerability-exists-in-the-public-form  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115196 · Severity: medium · CVSS 5.4 · Published 2026-10-26

Mautic is a marketing automation platform that allows organizations to create and publish web forms to capture visitor data. An unverified redirect vulnerability in the form submission endpoint allows attackers to trick users into visiting malicious websites by crafting specially prepared forms, potentially enabling phishing attacks or malware delivery. The vulnerability requires no authentication and affects any Mautic instance with published forms.

Technologies: [Mautic](https://junglewise.ai/threats/technologies/mautic). Vendors: [Mautic](https://junglewise.ai/threats/vendors/mautic).

## Quick answers

**Is CVE-2026-115196 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115196 being exploited in the wild.

**How severe is CVE-2026-115196?** Medium severity, with a CVSS score of 5.4, published 26 October 2026.

**Which products and versions are affected?** Mautic 1.0.0-beta to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1.

**Is there a fix for CVE-2026-115196?** Yes: fixed in 5.2.12, 6.0.10, 7.2.2. Until then: Configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own trusted websites. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115196 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-115196?** Check whether you run Mautic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.12, 6.0.10, 7.2.2

Configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own trusted websites.

## Technical details

An open redirect vulnerability exists in Mautic's /form/submit endpoint where user-supplied return URL parameters are not validated before being used in HTTP redirects. An unauthenticated attacker can craft a malicious form that, upon submission, redirects victims to arbitrary external hosts. The attack requires victim interaction (form submission) but succeeds over the network from any location.

## Affected products

- Mautic Mautic 1.0.0-beta to 5.2.11, 6.0.0 to 6.0.9, 7.0.0 to 7.2.1

## Timeline

- 2026-10-26: disclosed

## References

- [https://packagist.org/](https://packagist.org/)
- [https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868](https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868)

## Related threats

- [Mautic Stats API broken access control in permission enforcement](https://junglewise.ai/threats/cve-2026-115195-a-broken-access-control-vulnerability-exists-in-the-mautic-stats)
- [Mautic stored XSS in HTML-type custom contact fields](https://junglewise.ai/threats/cve-2026-115193-a-stored-cross-site-scripting-xss-vulnerability-exists-in-the)
- [Mautic SQL injection in dashboard widget API](https://junglewise.ai/threats/cve-2026-115192-an-sql-injection-vulnerability-exists-in-the-dashboard-widget)
- [Mautic SQL injection in contact lookup AJAX endpoint](https://junglewise.ai/threats/cve-2026-115191-a-sql-injection-vulnerability-exists-in-a-contact-lookup-ajax)
- [Mautic insecure deserialization in segment filters and custom fields](https://junglewise.ai/threats/cve-2026-115190-an-insecure-deserialization-php-object-injection-vulnerability)