CVE-2026-9557

En bref

Sévérité: MEDIUM 6.4
EPSS: EPSS 0.15 % · centile 4 (2026-10-27)
État: PUBLISHED
Publiée: 2026-05-29
Mise à jour: 2026-05-29
Attribuée par: Mautic
Statut NVD: Deferred

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	Mautic
CVSS 3.1	MEDIUM 6.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N	NVD · security@mautic.org (Secondary)

Faiblesses (CWE)

CWE-918

Avis

GHSA-jmv8-8j9j-rcpc — Mautic Focus component Vulnerable to SSRF

Références européennes

ENISA EUVD · EUVD-2026-33273
GCVE · GCVE-0-2026-9557

Produits affectés

Produit	Versions
mautic/core	affected 4.0.0 < 4.4.20 ; affected 5.0.0 < 5.2.11 ; affected 6.0.0 < 6.0.9 ; affected 7.0.0 < 7.1.2

Références

https://github.com/mautic/mautic/security/advisories/GHSA-jmv8-8j9j-rcpc

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD