Vulnerability · Published May 29, 2026 · Assigned by Mautic
CVE-2026-9808
High 7.1
In plain English
A high-severity incorrect authorization in mautic/core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | mautic/core | 7.1.2 | GHSA-2jrw-c95w-h43g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mautic/core | 7.0.0 – before 7.1.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N