CVE-2026-4776 Mautic has SQL Injection in API Contact Filtering
Authenticated API users can inject arbitrary SQL commands via nested query parameters in Mautic's contact filtering mechanism.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4776?
CVE-2026-4776 is a high-severity SQL injection vulnerability in mautic/core, published on 29 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.
Weakness: CWE-89
Which versions are affected by CVE-2026-4776?
8 open source packages ship an affected version, including mautic/core.
| Package | Affected | Fixed in |
|---|---|---|
mautic/core Packagist | From 2.6.0 to 4.4.13 | None |
mautic/core Packagist | From 2.6.0 to 4.4.13 | None |
mautic/core Packagist | From 5.0.0 | 5.2.11 |
mautic/core Packagist | From 5.0.0 | 5.2.11 |
mautic/core Packagist | From 6.0.0 | 6.0.9 |
mautic/core Packagist | From 6.0.0 | 6.0.9 |
2 more packages
mautic/core Packagist | From 7.0.0 | 7.1.2 |
mautic/core Packagist | From 7.0.0 | 7.1.2 |
How do I fix CVE-2026-4776?
Upgrade mautic/core to a fixed version for your release line: 5.2.11, 6.0.9 or 7.1.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-4776 being exploited?
There is no known exploitation of CVE-2026-4776 in the wild and no public exploit code.
Sources
Also known as GHSA-fcmw-wx57-9p75.