CVE-2022-25776

HIGH

Mautic 1.0.2-4.4.11 - Authenticated Incorrect Default Permissions

Title source: llm

Description

Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such as names and surnames, company names and stage names.

References (1)

Core 1

Core References

Third Party Advisory

https://github.com/mautic/mautic/security/advisories/GHSA-qjx3-2g35-6hv8

Scores

CVSS v3 8.3

EPSS 0.0040

EPSS Percentile 32.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-276

Status published

Products (2)

acquia/mautic 1.0.2 - 4.4.12

mautic/core 1.0.2 - 4.4.12Packagist

Published Sep 18, 2024

Tracked Since Feb 18, 2026