CVE-2026-9809

Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization [1]. Mautic versions 7.0.0 through 7.1.1 are affected; the Projects feature is absent in 6.x, 5.x, and 4.x branches [1].

Exploitation

An authenticated user with permissions to create or edit projects can inject a malicious script payload into a project name. When an administrative user navigates to an entity associated with that compromised project and hovers the cursor over its tag, the script executes in the context of the administrator's browser session [1]. No additional user interaction beyond hovering is required.

Impact

Successful exploitation allows the attacker to perform administrative actions on behalf of the victim, including modifying system configurations or exfiltrating sensitive data. The script runs with the same privileges as the target administrator, fully compromising the affected Mautic instance [1].

Mitigation

The vulnerability is patched in Mautic version 7.1.2 [1]. No official workarounds exist; administrators can mitigate risk by restricting project creation and modification permissions to trusted users only [1].