What is the CVSS score of CVE-2026-3105?

CVE-2026-3105 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Mautic are affected by CVE-2026-3105?

A SQL injection vulnerability in our contact activities API endpoint (CVSS 7.6) could allow attackers to access or manipulate sensitive contact data without authentication.. A patch is available.

How to fix or mitigate CVE-2026-3105?

Within 24 hours: Identify all systems using the affected API endpoint and assess exposure; enable enhanced logging on this endpoint. Within 7 days: Deploy WAF rules to block SQL injection patterns targeting the contact activities endpoint; consider temporary API rate limiting or IP whitelisting. Within 30 days: Evaluate network segmentation to restrict API access; establish vendor communication for patch timeline; conduct internal code review for similar vulnerabilities.

Mautic CVE-2026-3105

HIGH

SQL Injection (CWE-89)

2026-02-24 security@mautic.org

GHSA-r5j5-q42h-fc93

SQLi Mautic

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 24, 2026 - 20:27 nvd

HIGH 7.6

DescriptionCVE.org

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.

WorkaroundsNone.

ReferencesIf you have any questions or comments about this advisory:

Email us at security@mautic.org

AnalysisAI

Mautic's Contact Activity API endpoint is vulnerable to SQL injection due to insufficient validation of the sort direction parameter, allowing authenticated attackers to execute arbitrary SQL queries. This high-severity vulnerability (CVSS 7.6) affects multiple versions and could enable unauthorized data access or modification. No patch is currently available; users should contact security@mautic.org for mitigation guidance.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects the API component of Mautic. SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.

WorkaroundsNone.

Referen

RemediationAI

Update to version 4.4.19 or later. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.