CVE-2024-47053: Acquia Mautic Auth Bypass Vulnerability

CVE-2024-47053 Overview

CVE-2024-47053 is an authorization vulnerability in Acquia Mautic's HTTP Basic Authentication implementation for its API. Any authenticated user can retrieve all reports and their associated data through the API, regardless of role assignments. The flaw bypasses the Reporting Permissions > View Own and Reporting Permissions > View Others controls that should restrict access to non-System Reports. The issue is tracked under CWE-285: Improper Authorization and has a CVSS 3.1 base score of 7.7.

Critical Impact
Authenticated Mautic users can read report data belonging to other users and system-level reports via the API, exposing marketing analytics, contact activity, and campaign metrics.

Affected Products

Acquia Mautic (see vendor advisory for fixed version ranges)
Mautic instances exposing the API with HTTP Basic Authentication enabled
Deployments using role-based reporting permissions to segment report visibility

Discovery Timeline

2025-02-26 - CVE-2024-47053 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47053

Vulnerability Analysis

Mautic exposes report objects through its REST API. The API authorization layer does not enforce the same permission model used by the web application. When a user authenticates over HTTP Basic Authentication, the API returns report records without checking whether the caller holds View Own or View Others reporting permissions. As a result, low-privilege accounts can enumerate and read every report in the instance, including System Reports.

The vulnerability is an authorization bypass rather than an authentication flaw. Credentials are still required, but role checks are absent from the report endpoints. Attackers with any valid Mautic account, including accounts intended only for narrow marketing tasks, can retrieve sensitive report content.

Root Cause

The root cause is a missing authorization check in the API path handling report resources. The permission voter that governs the Mautic UI is not applied consistently to API responses, so the role hierarchy is not evaluated during API report retrieval. See the GitHub Security Advisory GHSA-8xv7-g2q3-fqgc for maintainer details.

Attack Vector

An attacker authenticates to the Mautic API using HTTP Basic Authentication with any valid account. The attacker then issues GET requests against the reports API endpoints. The server returns full report data without evaluating the caller's reporting permissions. Exploitation requires network access to the API and any legitimate credential set, including compromised low-privilege accounts.

No verified public exploit code is available. Refer to the Mautic API Settings Documentation for API endpoint structure.

Detection Methods for CVE-2024-47053

Indicators of Compromise

API requests to Mautic report endpoints originating from user accounts that do not hold View Own or View Others reporting permissions.
Bursts of sequential GET calls against report resource IDs, indicating enumeration.
HTTP Basic Authentication requests to the API from user agents or IP ranges that do not match normal marketing tooling.

Detection Strategies

Correlate authenticated API access logs with the role and permission set of each user, flagging report reads by accounts without reporting rights.
Alert on API responses returning report payloads to accounts that have never accessed the reporting UI.
Baseline normal API report request volume per account and flag deviations.

Monitoring Recommendations

Enable verbose API access logging in Mautic and forward events to a centralized log platform.
Retain HTTP Basic Authentication logs long enough to support retrospective review after patching.
Monitor for creation of new low-privilege API users that immediately begin querying report endpoints.

How to Mitigate CVE-2024-47053

Immediate Actions Required

Upgrade Mautic to the fixed version listed in GHSA-8xv7-g2q3-fqgc.
Audit all Mautic user accounts and revoke any credentials that are unused or over-provisioned.
Rotate API credentials for accounts that authenticate over HTTP Basic Authentication.
Review report contents to determine whether sensitive data was exposed to low-privilege users.

Patch Information

Acquia and the Mautic project have released fixed versions. Apply the update referenced in the GitHub Security Advisory GHSA-8xv7-g2q3-fqgc. After patching, verify that report API responses honor the Reporting Permissions > View Own and Reporting Permissions > View Others roles.

Workarounds

Disable HTTP Basic Authentication on the Mautic API until the patched version is deployed, per the Mautic API Settings Documentation.
Restrict API access at the network layer to trusted integration hosts using firewall rules or a reverse proxy allowlist.
Temporarily remove API access from user accounts that do not require it.

bash

# Example: restrict Mautic API access at the reverse proxy (nginx)
location /api/ {
    allow 10.0.0.0/24;   # trusted integration subnet
    deny  all;
    proxy_pass http://mautic_backend;
}