# CVE-2026-9808: Mautic Core authorization bypass in API v2 endpoints

Source: https://junglewise.ai/threats/cve-2026-9808-mautic-core-authorization-bypass-in-api-v2-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-9808 · Severity: high · CVSS 7.1 · Published 2026-05-29

Mautic, an open-source marketing automation platform, contains a security flaw in its version 7 API. This vulnerability allows users with limited access rights to bypass security restrictions and view or modify data belonging to other users, such as contacts, companies, and reports. This could lead to unauthorized data exposure and interference with marketing operations.

Technologies: [Mautic Core](https://junglewise.ai/threats/technologies/mautic-core), [mautic/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-mautic-core). Vendors: [Mautic](https://junglewise.ai/threats/vendors/mautic), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-9808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9808 being exploited in the wild.

**How severe is CVE-2026-9808?** High severity, with a CVSS score of 7.1, published 29 May 2026.

**Which products and versions are affected?** Mautic Core >= 7.0.0, < 7.1.2; mautic/core (Packagist) ECOSYSTEM:introduced=7.0.0,fixed=7.1.2.

**Is there a fix for CVE-2026-9808?** Yes. mautic/core (Packagist): upgrade to 7.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9808 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9808?** Check whether you run Mautic Core or mautic/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mautic/core (Packagist): upgrade to 7.1.2 or later

  ```sh
  composer require mautic/core:^7.1.2
  ```


## Technical details

An incorrect authorization vulnerability (CWE-863) exists in Mautic 7's API v2 endpoints, which utilize the API Platform. The root cause is a failure to properly enforce owner-scope restrictions (e.g., 'viewown' or 'editown' permissions) under specific conditions. An authenticated attacker with low-level API privileges can exploit this over the network to bypass ownership-logic controls. This allows the attacker to read or modify restricted resources, including reports, contacts, and companies, that should be inaccessible to them. The issue is fixed in version 7.1.2; versions 4.x, 5.x, and 6.x are not affected.

## Affected products

- Mautic Mautic Core >= 7.0.0, < 7.1.2

## Identifiers

- CVE-2026-9808
- GHSA-2jrw-c95w-h43g

## Timeline

- 2026-05-29: disclosed: Initial disclosure via NVD
- 2026-07-02: advisory: GitHub Advisory published
- 2026-07-02: patched: Version 7.1.2 released

## References

- [https://api.github.com/users/zerlyer](https://api.github.com/users/zerlyer)
- [https://github.com/zerlyer](https://github.com/zerlyer)
- [https://api.github.com/users/zerlyer/gists%7B/gist_id%7D](https://api.github.com/users/zerlyer/gists%7B/gist_id%7D)
- [https://api.github.com/users/zerlyer/repos](https://api.github.com/users/zerlyer/repos)
- [https://avatars.githubusercontent.com/u/94057918?v=4](https://avatars.githubusercontent.com/u/94057918?v=4)
- [https://api.github.com/users/zerlyer/events%7B/privacy%7D](https://api.github.com/users/zerlyer/events%7B/privacy%7D)

## Related threats

- [Mautic Asset API path traversal vulnerability](https://junglewise.ai/threats/cve-2026-115194-a-path-traversal-vulnerability-exists-in-the-mautic-asset-api)
- [Mautic Twig sandbox escape in theme templates](https://junglewise.ai/threats/cve-2026-115189-a-server-side-template-injection-vulnerability-exists-in-the)
- [Mautic stored XSS in project selector component](https://junglewise.ai/threats/cve-2026-9811-mautic-stored-xss-in-project-selector-component)
- [Mautic stored XSS in Projects component project tags](https://junglewise.ai/threats/cve-2026-9809-mautic-stored-xss-in-projects-component-project-tags)
- [Mautic path traversal in campaign import feature](https://junglewise.ai/threats/cve-2026-9559-mautic-path-traversal-in-campaign-import-feature)