PT-2026-44821 · Mautic · Mautic

Biayendgi + 3 · CVE-2026-9808 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions 7.0.0 through 7.1.1

Description An authorization bypass exists in the API v2 endpoints (utilizing API Platform). Roles configured with owner-scope restrictions, such as viewown or editown, are not properly enforced. This allows authenticated API users with low privileges to bypass ownership-logic controls to access or modify resources belonging to other users, including reports, contacts, and companies, thereby bypassing structural tenant and privilege boundaries.

Recommendations Update to version 7.1.2. Temporarily revoke API credentials or narrow access permissions for users whose roles rely on owner-scope permission containment.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-9808

GHSA-2JRW-C95W-H43G

Affected Products

Mautic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9808.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9808 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9808 · Security Note
• https://osv.dev/vulnerability/GHSA-2jrw-c95w-h43g · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-2jrw-c95w-h43g · Note
• https://packagist.org · Note
• https://t.me/cveNotify/208763 · Telegram Post