SQL Injection in Contact Activity API Sorting

Overview

CVE-2026-3105 is a SQL injection vulnerability affecting the API endpoint for retrieving contact activities in Mautic, an open-source marketing automation platform. The root cause lies in the query construction for the Contact Activity timeline, where the parameter controlling sort direction is not validated against an allowlist, allowing injection of arbitrary SQL [1][4].

Exploitation

Exploitation requires an authenticated user with API access to the contact activity endpoint. By manipulating the sort direction parameter, an attacker can inject custom SQL commands into the backend query. No authentication bypass or additional privileges beyond standard API access are needed to trigger the vulnerability [2][4]. The issue is present across multiple Mautic versions prior to the fixes.

Impact

A successful SQL injection attack could allow the attacker to read, modify, or delete arbitrary data from the Mautic database. This may lead to disclosure of sensitive contact information, campaign details, or further compromise of the application and underlying infrastructure [1][4]. The exact impact depends on database permissions, but given Mautic's role in marketing automation, data integrity and confidentiality are at significant risk.

Mitigation

The vulnerability is fixed in Mautic versions 4.4.19, 5.2.10, 6.0.8, and 7.0.1, as released on 2026-02-24 [1][3][4]. Users are strongly advised to update immediately, as no workarounds are available [2][4]. The official advisory (GHSA-r5j5-q42h-fc93) provides further details and links to the patched releases.