CVE-2026-4776

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-4776
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4776.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-4776
Aliases
Published
2026-05-29T06:58:24.087Z
Modified
2026-07-23T03:56:35.520453890Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
[none]
Details

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4776.json",
    "cna_assigner": "Mautic",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.6.0"
                },
                {
                    "fixed": "4.4.20"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/mautic/mautic

Affected ranges

Type
GIT
Repo
https://github.com/mautic/mautic
Events
Introduced
96b53794017cde917e1e4262ebaaae5099e3586a
Fixed
03865b3dfbe0064df47d176b897bbfe1ba60e1d3
Introduced
12f062e87dd1c470893724b12be7b623ecd22f2b
Fixed
bd92ad789274317c82f6e1e1179d56f7406bc702
Introduced
21ab270a3516635551d7464fc604f4e5e1ae3aea
Fixed
789364ee4aaf8aef5e6d91642336c1f446d5521b
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.2.11"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.0.9"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.1.2"
        }
    ]
}

Affected versions

5.*
5.0.0
5.1.0
5.2.0
5.2.1
5.2.10
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.8
5.2.9
6.*
6.0.0
6.0.0-alpha
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.6
6.0.7
6.0.8
7.*
7.0.0-alpha
7.0.0-beta
7.1.0
7.1.0-rc
7.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4776.json"