Broken access control in Mautic Stats API exposes internal tables
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Mautic core from 2.3.0 before 5.2.12, from 6.0.0 before 6.0.10, and from 7.0.0 before 7.2.2 has a missing authorization flaw in the Stats API endpoint /api/stats/{table}. Several internal tables were not permission-checked, so any authenticated API user, even one with no granted permissions, can read them. Exposed data includes the application audit log, stored visitor IP addresses and geolocation details, and tracked redirect URLs with channel mappings. An attacker needs only a valid API account, and the CVSS vector rates the confidentiality impact as high.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | mautic/core | 2.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 | 5.2.12, 6.0.10, 7.2.2 | Patch available | CNA |
- mautic/core Vendor— Affected 2.3.0 to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 Fixed in 5.2.12, 6.0.10, 7.2.2 Patch available CNA
Remediation
Upgrade mautic/core to 5.2.12, 6.0.10 or 7.2.2, depending on the release line in use. The sources do not list a vendor advisory identifier for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA mautic/core Fixed in 5.2.12, 6.0.10, 7.2.2
Vendor assessments
Timeline
- 2026-10-26 Threatist record created from CVE-2026-115195
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
Sources
- CVE-2026-115195 · CVE Program
- CVE-2026-115195 · NVD
- FIRST EPSS
- CVE-2026-115195 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences