Insufficient authentication in upgrade flow
Priority LOW 34CWE-306Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.
Summary
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fact that Mautic needs to be installed in a certain way to be vulnerable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00277 20th percentileScored 2026-11-07
Fix Fixed Mautic (Mautic): < 4.4.13, < 5.1.1.mautic/core (Packagist): 4.4.13, 5.1.1+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mautic | Mautic | >= 1.0.0-beta3 to before < 4.4.13; >= 5.0.0 to before < 5.1.1. | < 4.4.13, < 5.1.1. | Patch available | CNA |
| — | mautic/core (Packagist) | 1.0.0-beta3 to before 4.4.13 | 4.4.13 | Patch available | GHSA-qf6m-6m4g-rmrc |
| — | mautic/core (Packagist) | 5.0.0-alpha to before 5.1.1 | 5.1.1 | Patch available | GHSA-qf6m-6m4g-rmrc |
| — | mautic/core-lib (Packagist) | 1.0.0-beta3 to before 4.4.13 | 4.4.13 | Patch available | GHSA-qf6m-6m4g-rmrc |
| — | mautic/core-lib (Packagist) | 5.0.0-alpha to before 5.1.1 | 5.1.1 | Patch available | GHSA-qf6m-6m4g-rmrc |
- Mautic VendorMautic Affected >= 1.0.0-beta3 to before < 4.4.13; >= 5.0.0 to before < 5.1.1. Fixed in < 4.4.13, < 5.1.1. Patch available CNA
- mautic/core (Packagist) Vendor— Affected 1.0.0-beta3 to before 4.4.13 Fixed in 4.4.13 Patch available GHSA-qf6m-6m4g-rmrc
- mautic/core (Packagist) Vendor— Affected 5.0.0-alpha to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-qf6m-6m4g-rmrc
- mautic/core-lib (Packagist) Vendor— Affected 1.0.0-beta3 to before 4.4.13 Fixed in 4.4.13 Patch available GHSA-qf6m-6m4g-rmrc
- mautic/core-lib (Packagist) Vendor— Affected 5.0.0-alpha to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-qf6m-6m4g-rmrc
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* | 1.0.1 to before 4.4.13; 5.0.0 to before 5.1.1 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:* | 1.0.0 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:beta3:*:*:*:*:*:* | 1.0.0 beta3 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:* | 1.0.0 beta4 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:* | 1.0.0 rc1 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:* | 1.0.0 rc2 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:* | 1.0.0 rc3 | Vulnerable | Acquia |
| cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:* | 1.0.0 rc4 | Vulnerable | Acquia |
- cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:* Versions 1.0.1 to before 4.4.13; 5.0.0 to before 5.1.1 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:-:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:beta3:*:*:*:*:*:* Versions 1.0.0 beta3 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:beta4:*:*:*:*:*:* Versions 1.0.0 beta4 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:rc1:*:*:*:*:*:* Versions 1.0.0 rc1 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:rc2:*:*:*:*:*:* Versions 1.0.0 rc2 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:rc3:*:*:*:*:*:* Versions 1.0.0 rc3 Vulnerable ·Acquia
- cpe:2.3:a:acquia:mautic:1.0.0:rc4:*:*:*:*:*:* Versions 1.0.0 rc4 Vulnerable ·Acquia
Remediation
- Fix · CNA Mautic (Mautic) Fixed in < 4.4.13, < 5.1.1.
- Fix · GHSA-qf6m-6m4g-rmrc mautic/core (Packagist) Fixed in 4.4.13 Advisory →
- Fix · GHSA-qf6m-6m4g-rmrc mautic/core (Packagist) Fixed in 5.1.1 Advisory →
- Fix · GHSA-qf6m-6m4g-rmrc mautic/core-lib (Packagist) Fixed in 4.4.13 Advisory →
- Fix · GHSA-qf6m-6m4g-rmrc mautic/core-lib (Packagist) Fixed in 5.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-25770
- 2026-10-03 Alias added: GHSA-qf6m-6m4g-rmrc
References
Advisory 2
More Mautic vulnerabilities
- TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
- TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
- TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
- TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
- TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
- TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2022-25770 · CVE Program
- CVE-2022-25770 · NVD
- FIRST EPSS
- GHSA-qf6m-6m4g-rmrc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences