CVE-2026-115196

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description An open redirect occurs at the '/form/submit' endpoint. The application redirects visitors to a return address provided during submission without verifying if the destination is the Mautic instance or a trusted host. An unauthenticated attacker can use this to redirect users from a legitimate domain to external sites, such as phishing pages or malware distribution sites. This requires the victim to submit a form prepared by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.