CVE-2026-115195

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description A broken access control issue exists in the Mautic Stats API endpoint '/api/stats/{table}'. The system failed to enforce permissions for several internal tables, as administrator-only restrictions were not applied and tables lacking explicit permission mappings remained readable by default. Consequently, any authenticated API user, regardless of their assigned role or permissions, can access sensitive data. This includes the application audit log containing user actions and change details that may expose personal contact data, visitor IP addresses, geolocation details, and tracked redirect URLs with channel mappings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.