PT-2026-21791 · Mautic · Mautic

Escopecz

+2

·

Published

2026-02-24

·

Updated

2026-03-25

·

CVE-2026-3105

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Mautic versions 4.4.19 through 5.2.9 Mautic versions 6.0.0 through 6.0.7 Mautic versions 7.0.0 through 7.0.0
Description A SQL injection issue exists in the API endpoint used for retrieving contact activities. The vulnerability is located in the query construction for the Contact Activity timeline, where the parameter controlling sort direction lacks proper validation against an allowlist. This allows authenticated users to potentially inject arbitrary SQL commands via the API. The vulnerable parameter is related to the sort direction functionality.
Recommendations Update to Mautic version 4.4.19 or later. Update to Mautic version 5.2.10 or later. Update to Mautic version 6.0.8 or later. Update to Mautic version 7.0.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3105
GHSA-R5J5-Q42H-FC93

Affected Products

Mautic