CVE-2026-115195
Deferred Deferred - Pending Action

Broken Access Control in Mautic Stats API

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: Mautic

Description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115195
EUVD
EUVD-2026-109799

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
mautic mautic From 2.3.0 (inc) to 5.2.11 (inc)
mautic mautic From 6.0.0 (inc) to 6.0.9 (inc)
mautic mautic From 7.0.0 (inc) to 7.2.1 (inc)
mautic mautic *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in the Mautic Stats API endpoint /api/stats/{table}. It allows any authenticated API user, even those with minimal permissions, to read sensitive data from internal tables that should be restricted. This includes audit logs with user actions and personal data, visitor IP addresses, geolocation details, and redirect URLs.

Detection Guidance

To detect this vulnerability, check if your Mautic instance is running a vulnerable version (2.3.0 to 5.2.11, 6.0.0 to 6.0.9, or 7.0.0 to 7.2.1). Verify if unauthenticated or low-privilege users can access the /api/stats/{table} endpoint by attempting to query internal tables like audit logs or visitor data.

Impact Analysis

An attacker with API access could read sensitive data such as user actions, personal information, IP addresses, geolocation details, and redirect URLs. This could lead to privacy breaches, unauthorized data exposure, or further targeted attacks using the exposed information.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and IP addresses. It may also breach HIPAA if protected health information was exposed. Organizations must ensure proper access controls to maintain compliance with these regulations.

Mitigation Strategies

Immediately upgrade Mautic to a patched version (5.2.12, 6.0.10, or 7.2.2). If upgrading is not possible, disable the Stats API endpoint or restrict access to administrative users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart