CVE-2026-9808: Mautic Core API v2 Authorization Bypass Vulnerability
Summary
CVE-2026-9808: Mautic has an Authorization Bypass in API v2 Endpoints. Affects mautic/core versions >= 7.0.0, < 7.1.2. Fixed in 7.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage and automate their marketing campaigns. It provides features such as email marketing, lead management, and analytics. The platform utilizes an API for integrations and interactions, which is crucial for developers and users to extend its functionalities. However, a vulnerability has been identified in the API v2 endpoints that could compromise user data security.
Vulnerability Detail
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints, particularly affecting roles with owner-scope restrictions like 'viewown' or 'editown'. Under certain conditions, these restrictions are not enforced correctly, allowing low-privilege authenticated API users to access or modify resources that belong to other users. This vulnerability can lead to unauthorized access to sensitive information such as reports, contacts, and companies, thereby bypassing the intended tenant and privilege boundaries within the platform.
How To Fix
Minimum fixed version
7.1.2
This is the first release that contains the fix.
composer require mautic/core:7.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there are no official workarounds, it is recommended to temporarily revoke API credentials or narrow access permissions for users whose roles depend on owner-scope permission containment until the package can be updated.
Conclusion
The authorization bypass vulnerability in Mautic's API v2 endpoints poses a significant risk to user data security. It is crucial for users to update to the patched version 7.1.2 to safeguard against unauthorized access. Until an update can be applied, users should take precautionary measures to limit access for affected roles.
See every vulnerability recorded for mautic/core →
FAQ
The vulnerability is an authorization bypass that allows low-privilege users to access or modify resources they should not have access to.
The vulnerability affects Mautic version 7.0.0 to 7.1.1. Versions 6.x, 5.x, and 4.x are not affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
If you cannot update immediately, consider revoking API credentials or limiting access permissions for affected users as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
