Executive brief
Mautic, an open-source marketing automation platform, contains a security flaw in its version 7 API. This vulnerability allows users with limited access rights to bypass security restrictions and view or modify data belonging to other users, such as contacts, companies, and reports. This could lead to unauthorized data exposure and interference with marketing operations.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Mautic 7's API v2 endpoints, which utilize the API Platform. The root cause is a failure to properly enforce owner-scope restrictions (e.g., 'viewown' or 'editown' permissions) under specific conditions. An authenticated attacker with low-level API privileges can exploit this over the network to bypass ownership-logic controls. This allows the attacker to read or modify restricted resources, including reports, contacts, and companies, that should be inaccessible to them. The issue is fixed in version 7.1.2; versions 4.x, 5.x, and 6.x are not affected.
Affected products
- Mautic Mautic Core >= 7.0.0, < 7.1.2
Timeline
- 2026-05-29: disclosed: Initial disclosure via NVD
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Version 7.1.2 released