CVE-2026-115192
Deferred Deferred - Pending Action

SQL Injection in Mautic Dashboard Widget API

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mautic

Description
An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit this to inject SQL into these reporting queries. Using blind SQL injection techniques, the attacker can read arbitrary data from the Mautic database, including contact and other marketing data and user account data with password hashes. The injected SQL can also be used to slow down database queries, which can have a limited impact on availability. Data modification is not possible through this vulnerability. Exploitation requires the Mautic API to be enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115192
EUVD
EUVD-2026-109796

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mautic mautic From 2.8.1 (inc) to 5.2.12 (exc)
mautic mautic From 6.0.0 (inc) to 6.0.10 (exc)
mautic mautic From 7.0.0 (inc) to 7.2.2 (exc)
mautic mautic *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL Injection vulnerability in Mautic's dashboard widget data API endpoint. Chart filter parameters are not properly validated before being used in database queries. An authenticated user with API access can inject malicious SQL code into reporting queries, leading to blind SQL injection attacks.

Detection Guidance

To detect this vulnerability, monitor API logs for suspicious requests to /api/data/{type} endpoints. Look for unusual query parameters or patterns like single quotes, semicolons, or SQL keywords (e.g., UNION, SELECT, OR 1=1). Enable database query logging to identify slow or malformed queries. Use tools like SQLMap to test for blind SQL injection by sending crafted payloads to the API endpoint.

Impact Analysis

An attacker could read sensitive data from the Mautic database, including contact information, marketing data, and user account credentials (password hashes). It can also slow down database queries, causing limited availability impacts. Data modification is not possible through this vulnerability.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, which may violate GDPR and HIPAA compliance requirements. Exposure of user account data and contact information could result in regulatory penalties due to data breaches.

Mitigation Strategies

Immediately upgrade Mautic to versions 5.2.12, 6.0.10, or 7.2.2 or later. If upgrading is not possible, disable the Mautic API or restrict API access to trusted users only. Review and audit API user permissions to ensure least privilege. Monitor database performance for signs of query slowdowns caused by exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart