CVE-2026-115193
Deferred Deferred - Pending Action

Stored XSS in Mautic Contact Detail View

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mautic

Description
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115193
EUVD
EUVD-2026-109797

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mautic mautic From 7.0.0 (inc) to 7.2.1 (inc)
mautic mautic 7.2.2
mautic mautic 7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Mautic 7. It affects HTML-type custom contact fields where values are rendered without output sanitization. An attacker can inject a script payload through contact editing, the API, or form submissions. When another user views the contact's detail page, the script executes in their browser session.

Detection Guidance

To detect this vulnerability, inspect Mautic instances running version 7.0.0 to 7.2.1 for HTML-type custom contact fields. Check if malicious scripts are stored in these fields by reviewing contact data via the Mautic admin interface or database queries. Look for unusual script tags or payloads in field values.

Impact Analysis

An attacker could perform administrative actions on your behalf, such as creating new administrator accounts, changing system settings, or accessing sensitive contact and campaign data. This occurs when you view the affected contact's detail page.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Unauthorized administrative actions may also breach compliance with data integrity and confidentiality standards.

Mitigation Strategies

Upgrade Mautic to version 7.2.2 or later to patch the vulnerability. If upgrading is not possible, restrict contact editing permissions, limit API access, and avoid mapping public forms to HTML-type fields. Review and sanitize existing contact data for malicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115193. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart