Biayendgi

**Name of the Vulnerable Software and Affected Versions** Mautic versions 7.0.0 through 7.1.1 **Description** An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as `viewown` or `editown`, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries. **Recommendations** Update to version 7.1.2. Temporarily revoke API credentials or narrow access permissions for users whose roles rely on owner-scope permission containment.