{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115196", "assignerOrgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "state": "PUBLISHED", "assignerShortName": "Mautic", "dateReserved": "2026-10-22T06:43:09.882Z", "datePublished": "2026-10-26T12:50:18.637Z", "dateUpdated": "2026-10-26T12:50:18.637Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e", "shortName": "Mautic", "dateUpdated": "2026-10-26T12:50:18.637Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "affected": [{"collectionURL": "https://packagist.org", "packageName": "mautic/core", "repo": "https://github.com/mautic/mautic", "versions": [{"status": "affected", "version": "1.0.0-beta", "lessThan": "5.2.12", "versionType": "semver"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.10", "versionType": "semver"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.2.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker."}]}], "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}}], "workarounds": [{"lang": "en", "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own websites.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "There are no official workarounds. To mitigate this vulnerability without upgrading, configure a reverse proxy or web application firewall rule that blocks redirect responses from /form/submit to hosts other than your Mautic instance and your own websites."}]}], "credits": [{"lang": "en", "value": "George Chen (@geo-chen)", "type": "finder"}, {"lang": "en", "value": "Koda Reef (@kodareef5)", "type": "finder"}, {"lang": "en", "value": "Ibrahim zain (@ZeroXJacks)", "type": "finder"}, {"lang": "en", "value": "adminsun (@sun1024)", "type": "finder"}, {"lang": "en", "value": "John Linhart (@escopecz)", "type": "remediation developer"}, {"lang": "en", "value": "Patryk Gruszka (@patrykgruszka)", "type": "remediation reviewer"}, {"lang": "en", "value": "Leuchtfeuer Digital Marketing (@Leuchtfeuer)", "type": "sponsor"}], "source": {"advisory": "GHSA-5mm3-3g7p-9868", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://packagist.org", "defaultStatus": "unaffected", "packageName": "mautic/core", "repo": "https://github.com/mautic/mautic", "versions": [{"lessThan": "5.2.12", "status": "affected", "version": "1.0.0-beta", "versionType": "semver"}, {"lessThan": "6.0.10", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThan": "7.2.2", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}], "source": "security@mautic.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker."}], "id": "CVE-2026-115196", "lastModified": "2026-10-26T14:21:33.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@mautic.org", "type": "Secondary"}]}, "published": "2026-10-26T14:16:31.157", "references": [{"source": "security@mautic.org", "url": "https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868"}], "sourceIdentifier": "security@mautic.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security@mautic.org", "type": "Secondary"}]}

{}

{}