Quick answers
- Is CVE-2026-9808 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9808 being exploited in the wild.
- How severe is CVE-2026-9808?
- High severity, with a CVSS score of 7.1, published 29 May 2026.
- Which products and versions are affected?
- Mautic Core >= 7.0.0, < 7.1.2; mautic/core (Packagist) ECOSYSTEM:introduced=7.0.0,fixed=7.1.2.
- Is there a fix for CVE-2026-9808?
- Yes. mautic/core (Packagist): upgrade to 7.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9808 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-9808?
- Check whether you run Mautic Core or mautic/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mautic/core (Packagist): upgrade to 7.1.2 or later
composer require mautic/core:^7.1.2
Technical details
An incorrect authorization vulnerability (CWE-863) exists in Mautic 7's API v2 endpoints, which utilize the API Platform. The root cause is a failure to properly enforce owner-scope restrictions (e.g., 'viewown' or 'editown' permissions) under specific conditions. An authenticated attacker with low-level API privileges can exploit this over the network to bypass ownership-logic controls. This allows the attacker to read or modify restricted resources, including reports, contacts, and companies, that should be inaccessible to them. The issue is fixed in version 7.1.2; versions 4.x, 5.x, and 6.x are not affected.
Affected products
- Mautic Mautic Core >= 7.0.0, < 7.1.2
Identifiers
- CVE-2026-9808
- GHSA-2jrw-c95w-h43g
Timeline
- 2026-05-29: disclosed: Initial disclosure via NVD
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Version 7.1.2 released