Predictable Page Indexing Might Lead to Sensitive Data Exposure
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.
Summary
SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead to the unintended disclosure of draft content or sensitive information. Unauthorized Access to Unpublished Page Previews: The page preview functionality for unpublished content, accessible via predictable URLs (e.g., /page/preview/1, /page/preview/2), lacked proper authorization checks. This allowed any unauthenticated user to view content that was not yet intended for public release, and allowed search engines to index these private preview URLs, making the content publicly discoverable. MitigationMautic has patched this vulnerability by enforcing proper permission checks on preview pages. Users should upgrade to the patched version of Mautic or later.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mautic | Mautic | > 4.0 to before < 6.0.2, <5.4.6, <4.4.16 | < 6.0.2, <5.4.6, <4.4.16 | Patch available | CNA |
| — | mautic/core (Packagist) | 4.0.0 to before 4.4.16 | 4.4.16 | Patch available | GHSA-cqx4-9vqf-q3m8 |
| — | mautic/core (Packagist) | 5.0.0-alpha to before 5.2.6 | 5.2.6 | Patch available | GHSA-cqx4-9vqf-q3m8 |
| — | mautic/core (Packagist) | 6.0.0-alpha to before 6.0.2 | 6.0.2 | Patch available | GHSA-cqx4-9vqf-q3m8 |
- Mautic VendorMautic Affected > 4.0 to before < 6.0.2, <5.4.6, <4.4.16 Fixed in < 6.0.2, <5.4.6, <4.4.16 Patch available CNA
- mautic/core (Packagist) Vendor— Affected 4.0.0 to before 4.4.16 Fixed in 4.4.16 Patch available GHSA-cqx4-9vqf-q3m8
- mautic/core (Packagist) Vendor— Affected 5.0.0-alpha to before 5.2.6 Fixed in 5.2.6 Patch available GHSA-cqx4-9vqf-q3m8
- mautic/core (Packagist) Vendor— Affected 6.0.0-alpha to before 6.0.2 Fixed in 6.0.2 Patch available GHSA-cqx4-9vqf-q3m8
Remediation
- Fix · CNA Mautic (Mautic) Fixed in < 6.0.2, <5.4.6, <4.4.16
- Fix · GHSA-cqx4-9vqf-q3m8 mautic/core (Packagist) Fixed in 4.4.16 Advisory →
- Fix · GHSA-cqx4-9vqf-q3m8 mautic/core (Packagist) Fixed in 5.2.6 Advisory →
- Fix · GHSA-cqx4-9vqf-q3m8 mautic/core (Packagist) Fixed in 6.0.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-5257
- 2026-10-03 Alias added: GHSA-cqx4-9vqf-q3m8
References
More Mautic vulnerabilities
- TI-2022-09344 Cross-site scripting in Mautic CVSS 3.1CRITICAL 9.6
- TI-2024-02543 Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.3
- TI-2024-02544 Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic CVSS 3.1MEDIUM 5.4
- TI-2024-03218 Improper Access Control Leads to Server-Side Request Forgery in Mautic CVSS 3.1MEDIUM 5.0
- TI-2024-31435 Remote Code Execution & File Deletion in Asset Uploads CVSS 3.1CRITICAL 9.9
- TI-2018-05847 Mautic before 2.13.0 allows CSV injection. CVSS 3.0CRITICAL 9.8
Sources
- CVE-2025-5257 · CVE Program
- CVE-2025-5257 · NVD
- FIRST EPSS
- GHSA-cqx4-9vqf-q3m8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences