Open redirect in Mautic form submission endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-601.
Summary
Mautic, the open source marketing automation platform, contains an open redirect in the public form submission endpoint (/form/submit) affecting mautic/core from 1.0.0-beta before 5.2.12, from 6.0.0 before 6.0.10 and from 7.0.0 before 7.2.2. After a form is submitted, the application redirects the visitor to a supplied return address without checking that it points to a trusted host (CWE-601). An unauthenticated attacker can send visitors from a legitimate Mautic domain to an external website, such as a phishing page or a site that delivers malware, but the victim must submit a form the attacker prepared.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | mautic/core | 1.0.0-beta to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 | 5.2.12, 6.0.10, 7.2.2 | Patch available | CNA |
- mautic/core Vendor— Affected 1.0.0-beta to before 5.2.12; 6.0.0 to before 6.0.10; 7.0.0 to before 7.2.2 Fixed in 5.2.12, 6.0.10, 7.2.2 Patch available CNA
Remediation
Update mautic/core to version 5.2.12, 6.0.10 or 7.2.2, depending on the release line in use. The sources do not list a vendor advisory for this fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA mautic/core Fixed in 5.2.12, 6.0.10, 7.2.2
Timeline
- 2026-10-26 Threatist record created from CVE-2026-115196
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-26 Priority changed: MEDIUM → LOW
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences