CVE-2026-9808
CVE-2026-9808
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
mautic/core Packagist
- Versions
- 7.0.0
- 7.0.1
- 7.0.2
- 7.1.0
- 7.1.0-rc
- 7.1.1
- Affected ranges
- ECOSYSTEM: ≥ 7.0.0, < 7.1.2
Update to 7.1.2