GHSA-2jrw-c95w-h43g
Suggest an improvement- Source
- https://github.com/advisories/GHSA-2jrw-c95w-h43g
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2jrw-c95w-h43g/GHSA-2jrw-c95w-h43g.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-2jrw-c95w-h43g
- Aliases
-
- CVE-2026-9808
- Published
- 2026-07-02T19:49:00Z
- Modified
- 2026-07-02T20:00:08.035912966Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
- Summary
- Mautic has an Authorization Bypass in API v2 Endpoints
- Details
-
Summary
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as
viewownoreditown) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.Impact
Authenticated API users with limited roles can read or modify restricted resources—including reports, contacts, and companies—that they do not own and should not have access to. This bypasses structural tenant and privilege boundaries on the platform.
Patched Versions
This security issue has been addressed in the following release: * 7.1.2
Note: Mautic 6.x, 5.x, and 4.x branches are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.
Workarounds
There are no official workarounds. To mitigate this issue without upgrading, temporarily revoke API credentials or narrow access permissions for any users whose roles rely on owner-scope permission containment.
- Database specific
{ "github_reviewed_at": "2026-07-02T19:49:00Z", "nvd_published_at": "2026-05-29T12:16:26Z", "github_reviewed": true, "cwe_ids": [ "CWE-863" ], "severity": "HIGH" }- References
Affected packages
Packagist / mautic/core
Package
- Name
- mautic/core
- Purl
- pkg:composer/mautic%2Fcore