CVE-2026-71245
Received Received - Intake

SQL Injection in Mautic Lead Management

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean (which HTML-entity-encodes quotes and angle brackets but does not restrict other characters), and passes it into LeadRepository::buildQueryForGetLeadsByFieldValue where it is concatenated directly as a raw SQL column identifier ( = 'l.'.) rather than being validated against a whitelist of real column names or passed as a bound parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-10
Generated
2026-08-16
AI Q&A
2026-08-05
EPSS Evaluated
2026-08-15
NVD
CVE-2026-71245
EUVD
EUVD-2026-53318

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mautic mautic *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in Mautic where an attacker can manipulate the field parameter in a request to inject malicious SQL code. The application fails to properly validate or sanitize the field name before using it in a database query, allowing unauthorized access to data.

Detection Guidance

To detect this vulnerability, inspect Mautic installations for the affected file LeadBundle/Controller/AjaxController.php and check if the field parameter in getLeadIdsByFieldValueAction is properly validated. Look for direct SQL concatenation in LeadRepository::buildQueryForGetLeadsByFieldValue().

Commands: grep -r 'buildQueryForGetLeadsByFieldValue' /path/to/mautic/; grep -r 'InputHelper::clean' /path/to/mautic/LeadBundle/Controller/AjaxController.php

Impact Analysis

An attacker could exploit this to read, modify, or delete sensitive data in the database, such as user information or marketing campaign data. Since only a valid session is required, any authenticated user could potentially launch this attack.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Apply the latest security patch from Mautic if available. Review and restrict database access permissions for authenticated users. Monitor database queries for suspicious patterns involving field parameter manipulation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71245. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart