Mautic EUVD-2026-109800

The Mautic instance must have at least one published public form, and the public /form/submit endpoint must be reachable (its normal default state). Exploitation requires the victim to submit a form prepared by the attacker carrying an attacker-chosen return address - this user interaction (reflected in UI:R) is the primary limiting factor, meaning the attack cannot be fully automated against passive targets and depends on successful social engineering. No authentication is required (PR:N), and all versions below the fixed releases (5.2.12, 6.0.10, 7.2.2) are affected regardless of configuration.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N = 5.4 Medium) shows a network-reachable, low-complexity flaw needing no privileges but requiring victim interaction (the victim must submit an attacker-prepared form). The vuln.today Decision label is 'this_month' - meaning scheduled remediation, not immediate action. No CISA KEV listing and no EPSS score were supplied, so there is no signal of active or probable exploitation; absence of these is not proof of safety but does argue against widespread automated abuse. No proof-of-concept or exploit reference is present in the input - only the Mautic GHSA advisory itself - so this remains no public exploit identified at time of analysis. The signals are internally consistent: an open redirect (CWE-601) that leverages the trust of a legitimate Mautic domain to boost phishing/malware delivery. Real-world risk is driven less by direct system impact (the vulnerable server is not compromised) than by reputational/phishing abuse, and is capped by the UI:R requirement.

An attacker crafts a link or page that submits a published Mautic form while supplying a return address pointing to an attacker-controlled site. A targeted victim submits the form, and the Mautic instance redirects their browser from the trusted Mautic domain to a phishing clone of the landing page or a malware-delivery site. No public exploit code is identified at time of analysis, and the attack succeeds only because the victim trusts the originating Mautic domain.