CVE-2026-3105

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3105", "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "state": "PUBLISHED", "assignerShortName": "Mautic", "dateReserved": "2026-02-24T10:36:40.356Z", "datePublished": "2026-02-24T18:39:03.352Z", "dateUpdated": "2026-02-26T20:07:06.187Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "mautic/core", "product": "Mautic", "repo": "https://github.com/mautic/mautic", "vendor": "Mautic", "versions": [{"lessThan": "< 4.4.19 <5.2.10 <6.0.8 <7.0.1", "status": "affected", "version": ">= 2.10.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "q1uf3ng"}, {"lang": "en", "type": "remediation developer", "value": "parykgruszka"}, {"lang": "en", "type": "remediation reviewer", "value": "escopecz"}, {"lang": "en", "type": "sponsor", "value": "Leuchtfeuer Digital Marketing"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<h3>Summary</h3><p>This advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.</p><h3>Mitigation</h3><p>Please update to <strong>4.4.19</strong>, <strong>5.2.10</strong>, <strong>6.0.8</strong>, <strong>7.0.1</strong>&nbsp;or later.</p><h3>Workarounds</h3><p>None.</p><h3>References</h3><p>If you have any questions or comments about this advisory:</p><p>Email us at <a target=\"_blank\" rel=\"nofollow\">security@mautic.org</a></p><br>"}], "value": "SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.\n\nMitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1\u00a0or later.\n\nWorkaroundsNone.\n\nReferencesIf you have any questions or comments about this advisory:\n\nEmail us at security@mautic.org"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic", "dateUpdated": "2026-02-24T18:39:03.352Z"}, "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93"}], "source": {"advisory": "GHSA-r5j5-q42h-fc93", "discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-02-15T13:38:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-02-18T09:27:00.000Z", "value": "Report accepted"}, {"lang": "en", "time": "2026-02-24T14:55:00.000Z", "value": "Advisory published"}], "title": "SQL Injection in Contact Activity API Sorting", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T20:02:03.863722Z", "id": "CVE-2026-3105", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:07:06.187Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3105", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T20:02:03.863722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T20:06:54.809Z"}}], "cna": {"title": "SQL Injection in Contact Activity API Sorting", "source": {"advisory": "GHSA-r5j5-q42h-fc93", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "q1uf3ng"}, {"lang": "en", "type": "remediation developer", "value": "parykgruszka"}, {"lang": "en", "type": "remediation reviewer", "value": "escopecz"}, {"lang": "en", "type": "sponsor", "value": "Leuchtfeuer Digital Marketing"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/mautic/mautic", "vendor": "Mautic", "product": "Mautic", "versions": [{"status": "affected", "version": ">= 2.10.0", "lessThan": "< 4.4.19 <5.2.10 <6.0.8 <7.0.1", "versionType": "semver"}], "packageName": "mautic/core", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-15T13:38:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-02-18T09:27:00.000Z", "value": "Report accepted"}, {"lang": "en", "time": "2026-02-24T14:55:00.000Z", "value": "Advisory published"}], "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.\n\nMitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1\u00a0or later.\n\nWorkaroundsNone.\n\nReferencesIf you have any questions or comments about this advisory:\n\nEmail us at security@mautic.org", "supportingMedia": [{"type": "text/html", "value": "<h3>Summary</h3><p>This advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.</p><h3>Mitigation</h3><p>Please update to <strong>4.4.19</strong>, <strong>5.2.10</strong>, <strong>6.0.8</strong>, <strong>7.0.1</strong>&nbsp;or later.</p><h3>Workarounds</h3><p>None.</p><h3>References</h3><p>If you have any questions or comments about this advisory:</p><p>Email us at <a target=\"_blank\" rel=\"nofollow\">security@mautic.org</a></p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic", "dateUpdated": "2026-02-24T18:39:03.352Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3105", "state": "PUBLISHED", "dateUpdated": "2026-02-26T20:07:06.187Z", "dateReserved": "2026-02-24T10:36:40.356Z", "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "datePublished": "2026-02-24T18:39:03.352Z", "assignerShortName": "Mautic"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "mautic/core", "product": "Mautic", "repo": "https://github.com/mautic/mautic", "vendor": "Mautic", "versions": [{"lessThan": "< 4.4.19 <5.2.10 <6.0.8 <7.0.1", "status": "affected", "version": ">= 2.10.0", "versionType": "semver"}]}], "source": "security@mautic.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "810298B5-F979-4BED-B035-F82C33CB1875", "versionEndExcluding": "4.4.19", "versionStartIncluding": "2.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "B25B2FE0-300C-44E0-9D0C-7F07C7B44829", "versionEndExcluding": "5.2.10", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "831BD706-7A50-4774-A7D1-403830DDC0ED", "versionEndExcluding": "6.0.8", "versionStartIncluding": "6.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:acquia:mautic:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CC2F790-64D4-42A3-8435-F6D6B1F62146", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.\n\nMitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1\u00a0or later.\n\nWorkaroundsNone.\n\nReferencesIf you have any questions or comments about this advisory:\n\nEmail us at security@mautic.org"}, {"lang": "es", "value": "Resumen:\nEste aviso aborda una vulnerabilidad de inyecci\u00f3n SQL en el endpoint de la API utilizado para recuperar actividades de contacto. Existe una vulnerabilidad en la construcci\u00f3n de la consulta para la l\u00ednea de tiempo de Actividad de Contacto donde el par\u00e1metro responsable de determinar la direcci\u00f3n de ordenaci\u00f3n no fue validado estrictamente contra una lista de permitidos, permitiendo potencialmente a usuarios autenticados inyectar comandos SQL arbitrarios a trav\u00e9s de la API.\n\nMitigaci\u00f3n:\nPor favor, actualice a 4.4.19, 5.2.10, 6.0.8, 7.0.1 o posterior.\n\nSoluciones provisionales:\nNinguna.\n\nReferencias:\nSi tiene alguna pregunta o comentario sobre este aviso:\nEscriba un correo electr\u00f3nico a security@mautic.org"}], "id": "CVE-2026-3105", "lastModified": "2026-06-17T10:43:03.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security@mautic.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3105", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T20:02:03.863722Z", "version": "2.0.3"}}]}, "published": "2026-02-24T20:27:50.713", "references": [{"source": "security@mautic.org", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/mautic/mautic/security/advisories/GHSA-r5j5-q42h-fc93"}], "sourceIdentifier": "security@mautic.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@mautic.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,4.4.19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,5.2.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,6.0.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.10.0,7.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Mautic", "source": "cna", "vendor": "Mautic"}, "product": "mautic", "vendor": "mautic"}], "analysis": {"en": {"generated_at": "2026-04-17T15:41:46.908539+00:00", "value": {"mitigation_remediation": ["Update to Mautic version 4.4.19, 5.2.10, 6.0.8, or 7.0.1 or later to apply the vendor\u2019s SQL injection fix.", "Configure access controls so that only trusted roles or IP ranges can invoke the Contact Activity API, limiting the attack surface for authenticated users.", "Ensure that the sort direction parameter is validated against a strict allowlist of values (e.g., \"ASC\" or \"DESC\"), rejecting any unexpected input before query construction."], "summary": {"action": "Apply Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "Mautic Mautic. All releases prior to 4.4.19, 5.2.10, 6.0.8, or 7.0.1 are affected because they lack the necessary input validation for the sort direction parameter. Any Mautic deployment running an older version remains vulnerable.", "description_and_impact": "The vulnerability is a SQL injection flaw in Mautic\u2019s Contact Activity API sorting mechanism, where the sort direction parameter is not restricted to a defined allowlist. This allows authenticated users to inject arbitrary SQL commands, enabling unauthorized database read or write operations and potentially exposing or corrupting data. The weakness is identified as CWE\u201189, reflecting improper input validation that permits malicious query construction.", "risk_and_exploitability": "With a CVSS score of 7.6 the vulnerability is considered high severity, while an EPSS score of less than\u202f1\u202f% indicates a low probability of exploitation at the time of analysis. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers must have valid API credentials to reach the vulnerable endpoint, but once authenticated the flaw can be leveraged remotely over the network to execute arbitrary SQL against the underlying database, posing a significant confidentiality and integrity risk."}}}}, "created": "2026-02-25T11:35:49.385073+00:00", "updated": "2026-04-17T15:45:15.905880+00:00", "vendors": ["mautic", "mautic$PRODUCT$mautic"]}