CVE-2026-115191

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A SQL injection issue exists in the Mautic administration interface at the '/s/ajax' endpoint. The problem occurs because a request parameter used to select the contact field for searching is not properly validated before being included in a database query. Any authenticated user, regardless of their assigned role or permissions, can exploit this using blind techniques—such as boolean-based or time-based methods—to execute arbitrary SQL queries. This allows the attacker to read sensitive information from the database, including user accounts, email addresses, password hashes, contact data, and campaign content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.