CVE-2026-115195 A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-115195?
CVE-2026-115195 is a medium-severity vulnerability, published on 26 Oct 2026.
Official description
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As a result, any authenticated API user, including one whose role grants no permissions, could read data from these tables, including the application audit log with actions performed by all users and change details that may contain contact personal data, stored visitor IP addresses and their geolocation details, and tracked redirect URLs and their channel mappings.
Weakness: CWE-862
Which versions are affected by CVE-2026-115195?
How do I fix CVE-2026-115195?
No fix has been published for CVE-2026-115195 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-115195 being exploited?
There is no known exploitation of CVE-2026-115195 in the wild and no public exploit code.
Sources
Also known as GHSA-7j28-9rg4-wg63.