Vulnerability · Published Oct 26, 2026 · Assigned by Mautic
CVE-2026-115196
Medium 5.4
In plain English
A medium-severity open redirect in mautic/core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mautic/core | 1.0.0-beta – before 5.2.126.0.0 – before 6.0.107.0.0 – before 7.2.2 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N