CVE-2026-115195

MEDIUM 6.5

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.

CWE	CWE-862
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mautic/mautic/security/advisories/GHSA-7j28-9rg4-wg63

Credits

Bobur Abdugafforov (@abdugafforov-bobur) Joost Grunwald (@joostgrunwald) Wade Sparks (VulnCheck) (@wsparks-vc) Patryk Gruszka (@patrykgruszka) John Linhart (@escopecz) Leuchtfeuer Digital Marketing (@Leuchtfeuer)