PT-2026-44823 · Mautic · Mautic

John Linhart + 2 · CVE-2026-9811 · Published 2026-05-29 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 7.1.2

Description A stored Cross-Site Scripting (XSS) issue exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the Document Object Model (DOM) as option fields. An authenticated user with project creation permissions can store a malicious script payload in a project name. When an administrative user opens an entity editor containing the project selector, the script executes in their browser session, potentially leading to session hijacking, unauthorized state coordination, or unauthorized access to organizational data.

Recommendations Update to version 7.1.2. Restrict project creation and modification permissions to trusted administrative users.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9811

GHSA-5HVG-W58J-545M

Affected Products

Mautic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9811.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9811 · Security Note
• https://osv.dev/vulnerability/CVE-2026-9811 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hvg-w58j-545m · Vendor Advisory
• https://github.com/mautic/mautic · Note
• https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m · Note
• https://t.me/cveNotify/208765 · Telegram Post
• https://packagist.org · Note