CVE-2026-115192

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description An SQL Injection issue exists in the dashboard widget data API endpoint '/api/data/{type}'. This occurs because chart filter parameters provided by the client are not properly validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can use blind SQL injection—a technique used to retrieve data from a database by asking true/false questions—to read arbitrary information from the database, including contact details, marketing data, and user account password hashes. Additionally, the injected SQL can be used to slow down queries, potentially impacting availability. Data modification is not possible, and exploitation requires the Mautic API to be enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the '/api/data/{type}' API endpoint to minimize the risk of exploitation.