Mautic EUVD-2026-109799

Exploitation requires a valid authenticated Mautic API account and that the REST API is enabled; the account can hold a role granting no permissions. The specific trigger is requesting the Stats API endpoint /api/stats/{table} for internal tables that either had no explicit permission mapping (readable by default) or whose intended administrator-only restriction was never applied. Limiting factors: the attacker must already possess API credentials (PR:L), the impact is read-only disclosure of specific internal tables (audit log, visitor IP/geolocation, tracked redirect URLs/channel mappings) rather than arbitrary data, and instances with the API disabled or restricted to trusted administrative users are not exposed. The vendor states there are no official workarounds other than disabling the API or restricting API access to trusted administrative users; updating to 5.2.12, 6.0.10, or 7.2.2 is the complete fix.

This is a medium-severity broken access control flaw (CWE-862, CVSS 6.5) whose real-world priority sits below the raw score. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network-reachable, low-complexity exploitation but requires an authenticated API account (PR:L), and impact is confidentiality-only (C:H, I:N, A:N) - there is no write, code-execution, or availability consequence. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a disclosure-driven, not actively-exploited, issue. No CISA KEV listing, no EPSS score, and no SSVC breakdown were supplied, and no proof-of-concept or exploit reference was provided (only the vendor GHSA advisory), so there is no public exploit identified at time of analysis. The main caveat: C:H depends on reading an audit log that may contain contact PII, stored visitor IPs with geolocation, and tracked redirect/channel data - sensitive but bounded disclosure, not full database compromise. Net: a legitimate confidentiality/privacy concern for Mautic operators with multi-tenant or low-privilege API accounts, but not an emergency-grade exposure absent exploitation signals.

A low-privileged user who has been granted an API account on a Mautic instance (for example, a limited integration user whose role grants no permissions) sends authenticated GET requests to /api/stats/{table} for internal tables that lack an enforced permission mapping. Because the administrator-only restriction was never applied and unmapped tables defaulted to readable, the user harvests the application audit log, visitor IP/geolocation records, and tracked redirect URLs. No public exploit code is identified at time of analysis; exploitation is low-complexity but requires valid API credentials.