PT-2026-21791 · Mautic · Mautic

Escopecz + 2 · Published 2026-02-24 · Updated 2026-03-25 · CVE-2026-3105

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.4.19 Mautic versions prior to 5.2.10 Mautic versions prior to 6.0.8 Mautic versions prior to 7.0.1

Description A SQL injection issue exists in the API endpoint used for retrieving contact activities. The vulnerability is due to insufficient validation of the parameter controlling sort direction in the query construction for the Contact Activity timeline. This could allow authenticated users to inject arbitrary SQL commands via the API. The vulnerable parameter is not explicitly identified.

Recommendations Update to version 4.4.19 or later. Update to version 5.2.10 or later. Update to version 6.0.8 or later. Update to version 7.0.1 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-3105

GHSA-R5J5-Q42H-FC93

Affected Products

Mautic

References · 14

• https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-3105 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3105 · Security Note
• https://osv.dev/vulnerability/GHSA-r5j5-q42h-fc93 · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/releases/tag/7.0.1 · Note
• https://github.com/mautic/mautic/releases/tag/5.2.10 · Note
• https://github.com/mautic/mautic/releases/tag/6.0.8 · Note
• https://t.me/CVEtracker/45651 · Telegram Post
• https://twitter.com/_cvereports/status/2026774281602978055 · Twitter Post
• https://twitter.com/CVEnew/status/2026676440150970622 · Twitter Post
• https://twitter.com/q1uf3ng/status/2036824777642655889 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026478946926125064 · Twitter Post
• https://t.me/cveNotify/153404 · Telegram Post