PT-2025-23102 · Mautic · Mautic

John Linhart + 2 · Published 2025-05-28 · Updated 2025-05-30 · CVE-2025-5257

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description The issue concerns unauthorized access to unpublished page previews in Mautic, which could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. The page preview functionality for unpublished content, accessible via predictable URLs (e.g., "/page/preview/1", "/page/preview/2"), lacked proper authorization checks, allowing any unauthenticated user to view content not yet intended for public release.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1284

Related Identifiers

CVE-2025-5257

GHSA-CQX4-9VQF-Q3M8

Affected Products

Mautic

References · 9

• https://osv.dev/vulnerability/GHSA-cqx4-9vqf-q3m8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5257 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5257 · Security Note
• https://github.com/mautic/mautic/security/advisories/GHSA-cqx4-9vqf-q3m8 · Note
• https://github.com/mautic/mautic · Note
• https://twitter.com/VulmonFeeds/status/1927791075625771409 · Twitter Post
• https://twitter.com/CVEnew/status/1927768996771680580 · Twitter Post
• https://t.me/cvetracker/25049 · Telegram Post
• https://t.me/cvetracker/24843 · Telegram Post