Vulnerability · Published Feb 24, 2026 · Assigned by Mautic
CVE-2026-3105SQL Injection in Contact Activity API Sorting
High 7.6
In plain English
A high-severity SQL injection in Mautic from Mautic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API. MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later. WorkaroundsNone. ReferencesIf you have any questions or comments about this advisory: Email us at security@mautic.org
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 5.2.10 | GHSA-r5j5-q42h-fc93 |
| Packagist | mautic/core | 6.0.8 | GHSA-r5j5-q42h-fc93 |
| Packagist | mautic/core | 7.0.1 | GHSA-r5j5-q42h-fc93 |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L