What is the CVSS score of EUVD-2026-53318?

EUVD-2026-53318 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Mautic are affected by EUVD-2026-53318?

Mautic's lead management API contains a SQL injection vulnerability (CVE-2026-71245, CVSS 7.1) that allows authenticated users to extract arbitrary database contents.

How to fix or mitigate EUVD-2026-53318?

Within 24 hours: Audit all Mautic user accounts and immediately suspend unnecessary external or shared credentials; review access logs for suspicious getLeadIdsByFieldValueAction API calls. Within 7 days: Deploy Web Application Firewall rules to block requests containing SQL keywords or suspicious syntax in the field parameter; implement API rate limiting on the lead management endpoint; restrict network access to Mautic to trusted internal segments only. Within 30 days: Establish vendor patch monitoring and evaluate alternative platforms; strengthen access controls to limit lead API access to named, audited accounts; conduct a data inventory audit to identify which customer records were potentially exposed.

Mautic EUVD-2026-53318

| CVE-2026-71245 HIGH

SQL Injection (CWE-89)

2026-08-05 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

GHSA-rq57-g9hr-4f9r

PHP SQLi

7.1

CVSS 3.1 · Vendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Severity by source

Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-accessible web endpoint exploitable by any authenticated session (PR:L); no complexity barriers; SQL injection yields high confidentiality and limited integrity impact with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c).

CVSS VectorVendor: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 11:40 vuln.today

CVE Published

Aug 05, 2026 - 11:16 cve.org

HIGH 7.1

DescriptionCVE.org

Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue() where it is concatenated directly as a raw SQL column identifier ($col = 'l.'.$field) rather than being validated against a whitelist of real column names or passed as a bound parameter. Since Doctrine cannot parameterize identifiers, and the sanitizer does not block spaces, parentheses, or other SQL-relevant characters, an attacker can inject SQL via the field name itself. The action requires only a valid session (any authenticated user), unlike sibling actions in the same controller that carry additional permission checks.

AnalysisAI

SQL injection in Mautic's getLeadIdsByFieldValueAction endpoint allows any authenticated user to extract arbitrary database contents by supplying a malicious field parameter that is concatenated directly into a SQL query as an unvalidated column identifier. The flaw is rooted in Doctrine ORM's structural inability to parameterize SQL identifiers - the only sanitizer applied, InputHelper::clean(), HTML-entity-encodes quotes and angle brackets but leaves the spaces, parentheses, and SQL keywords needed for injection entirely intact. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low authentication barrier (any valid session) makes this a meaningful risk for organizations with untrusted or externally provisioned Mautic accounts.

Technical ContextAI

Mautic is a PHP-based open-source marketing automation platform built on Symfony and Doctrine ORM (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). The vulnerable code path is in LeadBundle/Controller/AjaxController.php inside getLeadIdsByFieldValueAction, which reads a field request parameter and passes it to LeadRepository::buildQueryForGetLeadsByFieldValue(). There, the identifier is assembled as $col = 'l.'.$field and concatenated directly into a raw SQL fragment. Doctrine's prepared-statement parameterization protects value placeholders but cannot protect SQL identifiers (column and table names) - those must be whitelisted by the application. Because InputHelper::clean() only HTML-encodes angle brackets and quote characters, it provides no defense against injection payloads that use spaces, parentheses, SQL keywords, or UNION-based constructs, all of which pass through unmodified. Unlike sibling actions in the same controller that enforce additional RBAC permission checks, this action requires only a valid authenticated session, broadening the potential attacker pool to any Mautic user regardless of role.

RemediationAI

No vendor-released patched version has been identified at time of analysis - the only available reference is the upstream GitHub repository (https://github.com/mautic/mautic) with no linked advisory or tagged release. Organizations should monitor the Mautic GitHub repository and official security advisories for a patch. The correct permanent fix requires the Mautic development team to replace unsanitized column-name concatenation in LeadRepository::buildQueryForGetLeadsByFieldValue() with a strict whitelist check that validates the field parameter against an explicit list of valid lead column names before use in any SQL context. As an immediate compensating control, access to Mautic's AJAX routes can be restricted at the WAF or reverse-proxy layer to trusted IP ranges or known internal user segments - note this will degrade legitimate AJAX-dependent UI functionality for affected users. A WAF rule blocking requests where the field parameter contains spaces, parentheses, SQL keywords, or characters outside [a-zA-Z0-9_] can reduce exploitability with a low rate of false positives on well-formed field names. Additionally, auditing Mautic database user privileges to apply least-privilege (read-only where possible) limits the blast radius of any successful injection.