Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115195

Quick assessment

Affected
CVE-2026-115195
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mautic 统计 API（ ）中存在访问控制失效漏洞。该端点未对多个内部数据表实施权限检查：原本应仅限管理员访问的限制从未生效，且未明确配置权限映射的数据表默认对任何已认证用户可读。因此，任何已认证的 API 用户（包括其角色未授予任何权限的用户）均可读取这些表中的数据，内容包括：记录所有用户操作的应用审计日志（可能包含联系人的个人数据）、存储的访客 IP 地址及其地理位置信息，以及被追踪的重定向 URL 及其渠道映射关系。

CVSS 6.5 · Medium

I. Basic Information for CVE-2026-115195

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 2.3.0 ~ 5.2.12 -

II. Public POCs for CVE-2026-115195

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115195

请登录查看更多情报信息。

Other References for CVE-2026-115195 (1)

IV. Related Vulnerabilities

Same weakness: CWE-862