CVE-2026-4776 - An SQL injection vulnerability exists in Mautic's API contact filtering mechanism

Back Back to CVE browser

HIGH

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism

Published May 29, 2026

7.1

HIGH

CVSS 3.1

EPSS 0.38%

Description

An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

Affected products

Remediation

Vendor solution

There are no official workarounds. To mitigate this issue without upgrading, you may temporarily disable API access or restrict API permissions to highly trusted accounts.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33256		Advisory
https://github.com/advisories/GHSA-fcmw-wx57-9p75		Advisory
https://github.com/mautic/mautic/security/advisories/GHSA-fcmw-wx57-9p75
https://nvd.nist.gov/vuln/detail/CVE-2026-4776