CVE-2018-10189

Vulnerability

Mautic versions 1.x and 2.x prior to 2.13.0 [1][2] implement contact tracking using a cookie whose value is derived from the auto-incremented database ID of the contact. No additional randomness or uniqueness per device is introduced. This design allows an attacker to systematically enumerate contact IDs by incrementing the cookie value by +1. The tracked contact information is then accessible through any form that has progressive profiling enabled, which collects and reveals data about the contact as they interact with the form.

Exploitation

An attacker needs only the ability to set or manipulate cookies in their browser or automated script. No authentication, special network position, or user interaction beyond visiting a Mautic-hosted page is required. By initializing a tracking cookie with a value of 1 and then sending requests with sequentially incremented cookie values (2, 3, etc.), the attacker can assume the identity of each contact in the system. For each assumed identity, any form that uses progressive profiling may return stored information about that contact, such as email address, name, or custom fields, depending on how the form is configured.

Impact

Successful exploitation allows an attacker to retrieve personal information about all contacts tracked by the Mautic instance. This can lead to mass data exposure, violating confidentiality of contact records. The impact is limited to information accessible through progressive profiling forms; the attacker does not gain direct administrative access or full database read. However, if forms collect sensitive fields (e.g., email, phone, address), a significant data breach can occur.

Mitigation

The vulnerability is fixed in Mautic version 2.13.0 [2][3]. In this release, contacts are tracked by a unique device ID instead of the auto-incremented ID, though legacy cookies remain supported for backward compatibility. Administrators should upgrade to 2.13.0 or later immediately. As a workaround for existing installations, if the "Identify visitor by tracking url" feature is not in use, it should be disabled in the Tracking Settings [2]. No other workaround is available [3].