CVE-2026-9808: Mautic has an Authorization Bypass in API v2 Endpoints

July 2, 2026

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as viewown or editown) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

References

github.com/advisories/GHSA-2jrw-c95w-h43g
github.com/mautic/mautic/security/advisories/GHSA-2jrw-c95w-h43g
nvd.nist.gov/vuln/detail/CVE-2026-9808

Code Behaviors & Features

Detect and mitigate CVE-2026-9808 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →