CVE-2026-71245 mautic CVE debrief

Who should care

Mautic users and administrators, security teams monitoring for SQL injection attacks, and developers using Mautic's AjaxController actions should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes verifying Mautic configurations, restricting access to AjaxController actions, and implementing whitelisting of real column names for SQL queries. Additionally, security teams should monitor for suspicious SQL queries and authentication activity, and developers should review and update their code to prevent similar vulnerabilities in the future. It is also essential to restrict access to authenticated users and sessions to minimize the attack surface. By taking these steps, organizations can reduce the risk of SQL injection attacks and protect their systems from potential exploitation. Mautic users should also consider implementing compensating controls, such as monitoring and detection systems, to identify and respond to potential security incidents. Furthermore, affected operators and platforms should be reviewed to ensure that they are properly configured and secured. Vulnerability management and security teams should prioritize this issue and work with developers to address the vulnerability and prevent similar issues in the future. This requires a coordinated effort to ensure that all stakeholders are aware of the vulnerability and are taking necessary steps to mitigate the risk. By working together, organizations can minimize the impact of this vulnerability and protect their systems from potential exploitation. The CVE record indicates that the vulnerability has not been modified since its publication, emphasizing the need for prompt action to address the issue. To ensure the security of their systems, Mautic users and administrators should prioritize this vulnerability and take immediate action to prevent exploitation. This includes reviewing and updating their configurations, implementing whitelisting of real column names, and monitoring for suspicious activity. By taking these steps, organizations can reduce the risk of SQL injection attacks and protect their systems from potential exploitation. The affected M

Technical summary

The getLeadIdsByFieldValueAction in Mautic's AjaxController is vulnerable to SQL injection. The field parameter is sanitized with InputHelper::clean(), which only HTML-entity-encodes quotes and angle brackets. The parameter is then concatenated directly into a SQL query as a column identifier without validation or parameterization. An attacker with a valid session can inject SQL via the field name.

Defensive priority

Authenticated users with session access should verify Mautic configurations and restrict access to AjaxController actions.

Recommended defensive actions

• Verify Mautic configurations and restrict access to AjaxController actions
• Implement whitelisting of real column names for SQL queries
• Monitor for suspicious SQL queries and authentication activity
• Restrict access to authenticated users and sessions
• Update Mautic to address SQL injection vulnerability

Evidence notes

The CVE-2026-71245 record indicates Mautic's getLeadIdsByFieldValueAction is vulnerable to SQL injection via field parameter. The action requires a valid session, and the issue arises from insufficient sanitization and direct concatenation of user input into SQL queries.

Official resources