Segment cloning doesn't have a proper permission check

Root

Cause An insecure direct object reference (IDOR) / missing authorization vulnerability exists in Mautic's segment management cloneAction. The endpoint fails to verify whether the authenticated user has the required permissions to create new segments, allowing unauthorized cloning [1][2][3].

Exploitation

An authenticated attacker can invoke the clone action on existing segments through the user interface or API without needing specific segment creation privileges. The vulnerability is triggered by sending a request to the clone endpoint, and no additional precondition beyond valid authentication is required [2][3].

Impact

By exploiting this lack of authorization, a user who would normally be denied the ability to create new segments can duplicate existing ones. This potentially enables the attacker to circumvent organizational permission controls, leading to unauthorized access to segment data or misuse of marketing resources [1][2].

Mitigation

The fix requires implementing proper authorization checks in the cloneAction method of ListController.php, ensuring that users possess appropriate creation permissions before cloning segments. Updating Mautic to the patched version is the only recommended mitigation; no workarounds are available [3].