Mautic EUVD-2026-109794

Requires a valid authenticated Mautic account of any kind - the advisory explicitly states exploitation works regardless of the role or permissions assigned, so no elevated privilege is needed, but anonymous/unauthenticated access is NOT sufficient (CVSS PR:L). The concrete trigger is a request to the administration AJAX endpoint /s/ajax using the action lead:getLeadIdsByFieldValue, where the request parameter that selects which contact field to search by is passed into a database query without proper validation. No user interaction is required (UI:N). Limiting factors: attacker must first hold or obtain credentials, and the vendor's partial mitigation (blocking /s/ajax with action lead:getLeadIdsByFieldValue at the web server or WAF, which only disables the duplicate-contact warning) reduces exposure without upgrading. Affected versions span >=2.1.0 up to the fixed 5.2.12, 6.0.10, and 7.2.2 branches.

This is a genuine but authentication-gated priority rather than an internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, score 7.1) shows a network-reachable, low-complexity attack with no user interaction, but PR:L confirms a valid Mautic account is required - so this is primarily a privilege-escalation / mass-data-exfiltration vector for any authenticated user, including the lowest-privileged ones. The high confidentiality impact is well-justified: blind SQLi against the Mautic DB user yields password hashes that enable offline cracking and lateral movement. No EPSS score was provided in the input and there is no CISA KEV listing, so there is no signal of active exploitation; exploitation status is no public exploit identified at time of analysis. The vuln.today priority is this_week, consistent with a serious authenticated flaw that is not yet weaponized - notable, patch promptly, but not an act_now/emergency label. The main uncertainty is exploitation volume: absence of EPSS and KEV data means real-world targeting cannot be estimated from the provided signals.

An attacker who holds or phishes any valid Mautic account - regardless of assigned role - sends crafted requests to the /s/ajax contact-lookup endpoint and manipulates the parameter that selects which contact field to search by, which is not validated before use in a SQL query. Using blind boolean-based or time-based techniques they progressively extract arbitrary database contents, including user email addresses and password hashes. No public exploit is identified at time of analysis; the attack is low-complexity (AC:L) once an account is obtained.