CVE-2026-115195
Description
A flaw was found in Mautic. Due to missing permission enforcement in the Stats application programming interface (API), internal database tables are accessible by default without proper authorization. An authenticated remote user, even with an account lacking assigned privileges, can query these endpoints to access sensitive records, leading to unauthorized information disclosure of application audit logs, personal user information, and visitor geolocation data.
Statement
This vulnerability is rated as Moderate severity because, although an attacker can access sensitive information such as audit trails and visitor tracking records, exploitation requires authenticated API credentials and does not permit modifying data or disrupting service availability. Mautic is not distributed or supported within Red Hat Enterprise Linux or any other Red Hat product lines. Consequently, standard Red Hat enterprise environments do not run this software and are not directly exposed to this flaw.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
