CVE-2026-4776: Mautic has SQL Injection in API Contact Filtering

July 2, 2026

An SQL injection vulnerability exists in Mautic’s API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.

References

github.com/advisories/GHSA-fcmw-wx57-9p75
github.com/mautic/mautic/security/advisories/GHSA-fcmw-wx57-9p75
nvd.nist.gov/vuln/detail/CVE-2026-4776

Code Behaviors & Features

Detect and mitigate CVE-2026-4776 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →