CVE-2026-4776: Mautic SQL injection in API contact filtering

Executive brief

Mautic, an open-source marketing automation platform, is affected by a security flaw in its API contact filtering system. An attacker with valid API credentials could bypass security filters to access sensitive information stored in the database, including customer personal data, system configurations, and user credentials. This could lead to significant data breaches and unauthorized access to the marketing platform's underlying infrastructure.

Technical details

A SQL injection vulnerability (CWE-89) exists in Mautic's API contact filtering mechanism. The root cause is the insufficient recursive sanitization of nested query parameters, which allows an authenticated API user to bypass input filters. By crafting malicious nested queries, an attacker can inject and execute arbitrary SQL commands against the backend database. This enables unauthorized retrieval of sensitive data, including PII and system credentials. The issue is resolved in versions 7.1.2, 6.0.9, 5.2.11, and 4.4.20 (ELTS).

Affected products

• Mautic core >= 2.6.0, <= 4.4.13; >= 5.0.0, < 5.2.11; >= 6.0.0, < 6.0.9; >= 7.0.0, < 7.1.2

Timeline

• 2026-05-29: disclosed: NVD publication date
• 2026-07-02: advisory: GitHub Advisory published

References

• https://api.github.com/users/Senku01
• https://github.com/Senku01
• https://api.github.com/users/Senku01/gists%7B/gist_id%7D
• https://api.github.com/users/Senku01/repos
• https://avatars.githubusercontent.com/u/60399486?v=4
• https://api.github.com/users/Senku01/events%7B/privacy%7D