CVE-2026-115191 in Mautic
Summary
by MITRE • 10/26/2026
A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax). A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this, regardless of the role or permissions assigned to the account. Using blind (boolean-based or time-based) techniques, the attacker can run arbitrary SQL queries against the Mautic database and read any data the Mautic database user can access, including Mautic user accounts with email addresses and password hashes, contact data, and campaign and email content.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in the Mautic administration interface represents a critical security flaw within its AJAX-based contact lookup functionality located at the /s/ajax endpoint. This issue stems from improper input validation of request parameters that dictate which database field is used for searching contacts. Specifically, the application fails to sanitize or parameterize these inputs before incorporating them into SQL queries executed against the backend database. Because this endpoint is accessible via standard HTTP requests and does not enforce strict type checking on the column selection logic, it creates a direct pathway for attackers to manipulate the structure of the underlying SQL statement rather than just its data values.
The severity of this vulnerability is significantly amplified by the fact that authentication alone is sufficient to exploit it, regardless of the user's role or permission level within the Mautic instance. This means that even users with minimal privileges, such as basic sales representatives or marketing coordinators who typically have limited access rights, can leverage this flaw to escalate their capabilities far beyond what was intended by the system administrators. The lack of proper authorization checks combined with the absence of input validation allows any authenticated user to bypass security controls and interact directly with the database engine using maliciously crafted payloads.
Exploitation of this vulnerability relies on blind SQL injection techniques, specifically boolean-based or time-based methods. Since the application may not return direct error messages or query results in the HTTP response, attackers must infer information by observing differences in page load times or subtle variations in the application's behavior based on true and false conditions injected into the query logic. Through iterative probing using these blind techniques, an attacker can systematically extract data from the database one bit at a time. This process allows for the exfiltration of sensitive information including Mautic user account details such as email addresses and password hashes, which are critical targets for credential stuffing or offline cracking attacks.
Beyond authentication credentials, the vulnerability exposes extensive proprietary business data stored within the Mautic platform. Attackers can retrieve contact records containing personal identifiable information (PII) of customers and leads, violating privacy regulations such as GDPR or CCPA depending on jurisdiction. Furthermore, access to campaign configurations and email content reveals strategic marketing plans and communication templates that could be used for social engineering attacks against clients or competitors. The ability to read any data accessible by the database user account means there are no inherent boundaries limiting what an attacker can view once they have established a foothold through this injection point.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command and falls under MITRE ATT&CK technique T1059 Command Scripting or T1190 Exploit Public-Facing Application depending on the specific vector utilized to trigger the initial request. The impact is categorized as a breach of confidentiality, potentially leading to data exfiltration and unauthorized access to critical business assets.
Mitigation strategies must focus immediately on implementing parameterized queries or prepared statements for all database interactions involving user-supplied input, particularly in AJAX endpoints that handle dynamic field selections. Developers should enforce strict allow-listing for column names rather than relying solely on escaping special characters, as blind injection techniques can often bypass simple string-based sanitization measures. Additionally, applying the principle of least privilege to the database account used by Mautic ensures that even if an injection occurs, the scope of accessible data is minimized. Regular security audits and static code analysis focused on SQL query construction are recommended to prevent similar vulnerabilities in future releases or custom modules.