CVE-2026-4776

Vulnerability

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. The flaw stems from insufficient recursive sanitization of nested query parameters, allowing an authenticated API user to bypass input filtering and inject arbitrary SQL commands. Affected versions include all releases prior to 7.1.2, 6.0.9, 5.2.11, and 4.4.20 (ELTS) [1].

Exploitation

An attacker must have a valid API user account with access to the contact endpoint. By crafting nested query parameters that bypass the sanitization filter, the attacker can inject arbitrary SQL commands into the underlying database query. No further user interaction is required [1].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries against the database, enabling unauthorized retrieval of sensitive data such as user credentials, system configurations, and personally identifiable information (PII) of contacts, bypassing standard data access permissions [1].

Mitigation

Mautic has released fixed versions: 7.1.2, 6.0.9, 5.2.11, and 4.4.20 (ELTS). Users should upgrade to the appropriate patched release immediately. No official workarounds are available; as a temporary measure, administrators may disable API access or restrict API permissions to highly trusted accounts [1].