Open Redirect Vulnerability in Mautic Form Submission

Executive Summary

CVE-2026-115196 is an Open Redirect vulnerability in Mautic, a marketing automation platform. The issue exists in the public form submission endpoint (/form/submit), where the application redirects users to a return address provided during form submission without verifying if it belongs to the Mautic instance or a trusted host. An unauthenticated attacker can exploit this by crafting a malicious form that, when submitted by a victim, redirects them from a legitimate Mautic domain to an arbitrary external website.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for redirects from /form/submit to external domains. Check web server logs for unusual redirect patterns or requests to untrusted hosts. Use tools like curl to test forms for open redirect behavior by submitting a form with a malicious return URL.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by attackers to send users from a legitimate Mautic domain to phishing pages that imitate the original landing page or to sites that deliver malware. Victims must submit a form prepared by the attacker for exploitation to occur.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Mautic to patched versions (7.2.2, 6.0.10, or 5.2.12). If upgrading is not possible, configure a reverse proxy or WAF to block redirects from /form/submit to untrusted hosts. Disable or restrict access to public forms until mitigation is applied.

Useful 0 Not Useful 0