Vulnerability-Lookup

CVE-2026-9811 (GCVE-0-2026-9811)

Vulnerability from cvelistv5 – Published: 2026-05-29 10:41 – Updated: 2026-05-29 14:34

Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Mautic

References

1 reference

URL	Tags
https://github.com/mautic/mautic/security/advisor…

Impacted products

1 product

Vendor	Product	Version
		Affected: 7.0.0 , < 7.1.2 (semver)

Credits

@pavelkohout396 John Linhart (@escopecz) Patryk Gruszka (@patrykgruszka) Leuchtfeuer Digital Marketing (@Leuchtfeuer)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9811",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T14:34:05.375066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T14:34:13.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "repo": "https://github.com/mautic/mautic",
          "versions": [
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "@pavelkohout396"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "John Linhart (@escopecz)"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Patryk Gruszka (@patrykgruszka)"
        },
        {
          "lang": "en",
          "type": "sponsor",
          "value": "Leuchtfeuer Digital Marketing (@Leuchtfeuer)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard."
            }
          ],
          "value": "A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T10:41:29.041Z",
        "orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
        "shortName": "Mautic"
      },
      "references": [
        {
          "url": "https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m"
        }
      ],
      "source": {
        "advisory": "GHSA-5hvg-w58j-545m",
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users."
            }
          ],
          "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
    "assignerShortName": "Mautic",
    "cveId": "CVE-2026-9811",
    "datePublished": "2026-05-29T10:41:29.041Z",
    "dateReserved": "2026-05-28T08:07:14.977Z",
    "dateUpdated": "2026-05-29T14:34:13.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-9811",
      "date": "2026-08-03",
      "epss": "0.00133",
      "percentile": "0.03231"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-9811\",\"sourceIdentifier\":\"security@mautic.org\",\"published\":\"2026-05-29T12:16:27.030\",\"lastModified\":\"2026-07-21T12:10:00.090\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en el componente selector de proyectos de Mautic 7. Al renderizar men\u00fas de selecci\u00f3n para asociar proyectos con entidades del sistema, la aplicaci\u00f3n no sanitiza los nombres de proyectos devueltos v\u00eda AJAX antes de inyectarlos en el DOM como campos de opci\u00f3n. Un usuario autenticado con permisos para crear proyectos puede explotar esto para almacenar una carga \u00fatil de script malicioso en el nombre del proyecto. Cuando otro usuario administrativo posteriormente abre un editor de entidades que contiene el selector de proyectos, el script inyectado se ejecuta dentro del contexto de su sesi\u00f3n de navegador activa. Esto podr\u00eda permitir a un atacante secuestrar la sesi\u00f3n, realizar una coordinaci\u00f3n de estado no autorizada o acceder a datos organizacionales dentro del panel de control.\"}],\"affected\":[{\"source\":\"security@mautic.org\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://packagist.org\",\"packageName\":\"mautic/core\",\"repo\":\"https://github.com/mautic/mautic\",\"versions\":[{\"version\":\"7.0.0\",\"lessThan\":\"7.1.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":5.4,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-29T14:34:05.375066Z\",\"id\":\"CVE-2026-9811\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@mautic.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m\",\"source\":\"security@mautic.org\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:33:48+00:00",
      "cve": "CVE-2026-9811",
      "id": "CVE-2026-9811",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-9811",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9811.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-9811\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-29T14:34:05.375066Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-29T14:34:09.758Z\"}}], \"cna\": {\"source\": {\"advisory\": \"GHSA-5hvg-w58j-545m\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"@pavelkohout396\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"John Linhart (@escopecz)\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Patryk Gruszka (@patrykgruszka)\"}, {\"lang\": \"en\", \"type\": \"sponsor\", \"value\": \"Leuchtfeuer Digital Marketing (@Leuchtfeuer)\"}], \"impacts\": [{\"capecId\": \"CAPEC-592\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-592 Stored XSS\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/mautic/mautic\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.1.2\", \"versionType\": \"semver\"}], \"packageName\": \"mautic/core\", \"collectionURL\": \"https://packagist.org\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"4e531c38-7a33-45d3-98dd-d909c0d8852e\", \"shortName\": \"Mautic\", \"dateUpdated\": \"2026-05-29T10:41:29.041Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-9811\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-29T14:34:13.971Z\", \"dateReserved\": \"2026-05-28T08:07:14.977Z\", \"assignerOrgId\": \"4e531c38-7a33-45d3-98dd-d909c0d8852e\", \"datePublished\": \"2026-05-29T10:41:29.041Z\", \"assignerShortName\": \"Mautic\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-9811

Vulnerability from fkie_nvd - Published: 2026-05-29 12:16 - Updated: 2026-07-21 12:10

Severity

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security@mautic.org	https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "mautic/core",
          "repo": "https://github.com/mautic/mautic",
          "versions": [
            {
              "lessThan": "7.1.2",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@mautic.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en el componente selector de proyectos de Mautic 7. Al renderizar men\u00fas de selecci\u00f3n para asociar proyectos con entidades del sistema, la aplicaci\u00f3n no sanitiza los nombres de proyectos devueltos v\u00eda AJAX antes de inyectarlos en el DOM como campos de opci\u00f3n. Un usuario autenticado con permisos para crear proyectos puede explotar esto para almacenar una carga \u00fatil de script malicioso en el nombre del proyecto. Cuando otro usuario administrativo posteriormente abre un editor de entidades que contiene el selector de proyectos, el script inyectado se ejecuta dentro del contexto de su sesi\u00f3n de navegador activa. Esto podr\u00eda permitir a un atacante secuestrar la sesi\u00f3n, realizar una coordinaci\u00f3n de estado no autorizada o acceder a datos organizacionales dentro del panel de control."
    }
  ],
  "id": "CVE-2026-9811",
  "lastModified": "2026-07-21T12:10:00.090",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "security@mautic.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9811",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-29T14:34:05.375066Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-29T12:16:27.030",
  "references": [
    {
      "source": "security@mautic.org",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m"
    }
  ],
  "sourceIdentifier": "security@mautic.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security@mautic.org",
      "type": "Secondary"
    }
  ]
}

GHSA-5HVG-W58J-545M

Vulnerability from github – Published: 2026-07-02 19:49 – Updated: 2026-07-02 19:49

Summary

Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

Details

Summary

Impact

When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.

Patched Versions

This security issue has been addressed in the following release: * 7.1.2

Note: Mautic 6.x, 5.x, and 4.x branches do not contain the Projects feature or the associated AJAX selector and are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.

Workarounds

There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.

Severity

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "mautic/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.1.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-9811"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T19:49:27Z",
    "nvd_published_at": "2026-05-29T12:16:27Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project\u0027s name.\n\n### Impact\nWhen another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.\n\n### Patched Versions\nThis security issue has been addressed in the following release:\n* **7.1.2**\n\n*Note: Mautic 6.x, 5.x, and 4.x branches do not contain the Projects feature or the associated AJAX selector and are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the [ELTS](https://mautic.org/extended-long-term-support-elts/) page.*\n\n### Workarounds\nThere are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.",
  "id": "GHSA-5hvg-w58j-545m",
  "modified": "2026-07-02T19:49:27Z",
  "published": "2026-07-02T19:49:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9811"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mautic/mautic"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector"
}

WID-SEC-W-2026-1724

Vulnerability from csaf_certbund - Published: 2026-05-28 22:00 - Updated: 2026-05-31 22:00

Summary

Mautic: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Mautic ist eine Open-Source-Marketing-Automatisierungsplattform, die Unternehmen bei der Verwaltung von Marketingkampagnen und der Kundenbeziehungspflege unterstützt.

Angriff: Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um SQL-Injection- und Server-Side Request Forgery (SSRF)-Angriffe durchzuführen und um Informationen offenzulegen, beliebigen JavaScript-Code im Browser anderer Benutzer auszuführen, Dateien außerhalb vorgesehener Verzeichnisse einzubinden oder zu manipulieren sowie unter Umständen beliebigen Code auf dem Server auszuführen.

Betroffene Betriebssysteme: - Linux - UNIX

CVE-2026-4776

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9557

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9558

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9559

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9808

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9809

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

CVE-2026-9811

Affected products

Known affected 4 products

Product	Identifier	Version	Remediation
Open Source Mautic <6.0.9 Open Source / Mautic		<6.0.9
Open Source Mautic <7.1.2 Open Source / Mautic		<7.1.2
Open Source Mautic <4.4.20 Open Source / Mautic		<4.4.20
Open Source Mautic <5.2.11 Open Source / Mautic		<5.2.11

References

9 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external
https://github.com/mautic/mautic/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Mautic ist eine Open-Source-Marketing-Automatisierungsplattform, die Unternehmen bei der Verwaltung von Marketingkampagnen und der Kundenbeziehungspflege unterst\u00fctzt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Mautic ausnutzen, um SQL-Injection- und Server-Side Request Forgery (SSRF)-Angriffe durchzuf\u00fchren und um Informationen offenzulegen, beliebigen JavaScript-Code im Browser anderer Benutzer auszuf\u00fchren, Dateien au\u00dferhalb vorgesehener Verzeichnisse einzubinden oder zu manipulieren sowie unter Umst\u00e4nden beliebigen Code auf dem Server auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1724 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1724.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1724 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1724"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-fcmw-wx57-9p75 vom 2026-05-28",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-fcmw-wx57-9p75"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-jmv8-8j9j-rcpc vom 2026-05-28",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-jmv8-8j9j-rcpc"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-2jrw-c95w-h43g vom 2026-05-29",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-2jrw-c95w-h43g"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5hvg-w58j-545m vom 2026-05-29",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6r9h-4h75-7q4x vom 2026-05-29",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-6r9h-4h75-7q4x"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-7h65-whp7-rgqf vom 2026-05-29",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-7h65-whp7-rgqf"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-9fx4-7cmj-47vg vom 2026-05-29",
        "url": "https://github.com/mautic/mautic/security/advisories/GHSA-9fx4-7cmj-47vg"
      }
    ],
    "source_lang": "en-US",
    "title": "Mautic: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-31T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-01T06:37:37.538+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1724",
      "initial_release_date": "2026-05-28T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-28T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-31T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-33276, EUVD-2026-33273, EUVD-2026-33280, EUVD-2026-33279, EUVD-2026-33278, EUVD-2026-33277"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.1.2",
                "product": {
                  "name": "Open Source Mautic \u003c7.1.2",
                  "product_id": "T054858"
                }
              },
              {
                "category": "product_version",
                "name": "7.1.2",
                "product": {
                  "name": "Open Source Mautic 7.1.2",
                  "product_id": "T054858-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mautic:mautic:7.1.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.0.9",
                "product": {
                  "name": "Open Source Mautic \u003c6.0.9",
                  "product_id": "T054859"
                }
              },
              {
                "category": "product_version",
                "name": "6.0.9",
                "product": {
                  "name": "Open Source Mautic 6.0.9",
                  "product_id": "T054859-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mautic:mautic:6.0.9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.2.11",
                "product": {
                  "name": "Open Source Mautic \u003c5.2.11",
                  "product_id": "T054862"
                }
              },
              {
                "category": "product_version",
                "name": "5.2.11",
                "product": {
                  "name": "Open Source Mautic 5.2.11",
                  "product_id": "T054862-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mautic:mautic:5.2.11"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.4.20",
                "product": {
                  "name": "Open Source Mautic \u003c4.4.20",
                  "product_id": "T054863"
                }
              },
              {
                "category": "product_version",
                "name": "4.4.20",
                "product": {
                  "name": "Open Source Mautic 4.4.20",
                  "product_id": "T054863-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:mautic:mautic:4.4.20"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Mautic"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-4776",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-4776"
    },
    {
      "cve": "CVE-2026-9557",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9557"
    },
    {
      "cve": "CVE-2026-9558",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9558"
    },
    {
      "cve": "CVE-2026-9559",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9559"
    },
    {
      "cve": "CVE-2026-9808",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9808"
    },
    {
      "cve": "CVE-2026-9809",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9809"
    },
    {
      "cve": "CVE-2026-9811",
      "product_status": {
        "known_affected": [
          "T054859",
          "T054858",
          "T054863",
          "T054862"
        ]
      },
      "release_date": "2026-05-28T22:00:00.000+00:00",
      "title": "CVE-2026-9811"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-9811 (GCVE-0-2026-9811)

FKIE_CVE-2026-9811

GHSA-5HVG-W58J-545M

Summary

Impact

Patched Versions

Workarounds

WID-SEC-W-2026-1724

Tags

Sightings

Nomenclature