PT-2026-44822 · Mautic · Mautic

34Selen + 2 · CVE-2026-9809 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 7.1.2

Description A stored Cross-Site Scripting (XSS) issue exists in the Projects component. When administrative detail views for campaigns, emails, or forms display project tags and popovers, user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can inject malicious script payloads. When an administrator hovers over a tag associated with a compromised project, the script executes in their browser session, potentially allowing the attacker to perform administrative actions, change system configurations, or exfiltrate sensitive data.

Recommendations Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9809

GHSA-7H65-WHP7-RGQF

Affected Products

Mautic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9809.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9809 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7h65-whp7-rgqf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9809 · Security Note
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-7h65-whp7-rgqf · Note
• https://packagist.org · Note
• https://t.me/cveNotify/208764 · Telegram Post