CVE-2026-71245

Name of the Vulnerable Software and Affected Versions Mautic (affected versions not specified)

Description The getLeadIdsByFieldValueAction function in LeadBundle/Controller/AjaxController.php is susceptible to SQL injection. The issue occurs because the function reads a field parameter from the request and sanitizes it using InputHelper::clean(), which only encodes HTML entities but does not restrict characters like spaces or parentheses. This value is then passed to LeadRepository::buildQueryForGetLeadsByFieldValue(), where it is concatenated directly as a raw SQL column identifier. Because Doctrine cannot parameterize identifiers, an authenticated user can inject SQL commands through the field parameter. This specific action lacks the additional permission checks found in other functions within the same controller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.