Security advisory
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-115196
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 12:02 UTC · Revision 1
Source evidence
An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.
cve:CVE-2026-115196
Complete source record
{
"id": "54b49cffd2b219f4cfb97af0e4f34547801ab6f5a8fae3a876296c00025603b3",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-115196",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-115196",
"summary": "An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. An unauthenticated attacker can exploit this to send visitors from a legitimate Mautic domain to an arbitrary external website, for example to phishing pages that imitate the original landing page or to sites that deliver malware. Any Mautic instance with a published form is affected. Exploitation requires the victim to submit a form prepared by the attacker.",
"evidence": "cve:CVE-2026-115196",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-115196",
"aliases": [
"CVE-2026-115196"
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.4,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"affected": [
{
"repo": "https://github.com/mautic/mautic",
"versions": [
{
"status": "affected",
"version": "1.0.0-beta",
"lessThan": "5.2.12",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.0.10",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.2.2",
"versionType": "semver"
}
],
"packageName": "mautic/core",
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected"
}
],
"modified": "2026-10-26T15:35:52.657Z",
"provider": "cve",
"references": [
"https://github.com/mautic/mautic/security/advisories/GHSA-5mm3-3g7p-9868"
],
"provider_metadata": {
"adp": [
{
"title": "CISA ADP Vulnrichment",
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-115196",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-26T14:59:35.349590Z"
}
}
}
],
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-10-26T15:35:52.657Z"
}
}
],
"cna": {
"orgId": "4e531c38-7a33-45d3-98dd-d909c0d8852e",
"shortName": "Mautic",
"dateUpdated": "2026-10-26T12:50:18.637Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-115196",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": "/containers/cna/metrics"
},
"source_id": "core-cve",
"document_id": 316055,
"published_at": "2026-10-26T12:50:18.637+00:00"
}