Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (su

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mautic

Description

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

mautic/core

Default version status: unaffected

  • 7.0.0 to < 7.1.2affected

References