CVE-2026-71245: Mautic SQL Injection Vulnerability

CVE-2026-71245 Overview

CVE-2026-71245 is a SQL injection vulnerability [CWE-89] in Mautic's getLeadIdsByFieldValueAction handler located in LeadBundle/Controller/AjaxController.php. The flaw allows any authenticated user to inject SQL through the field request parameter. Mautic sanitizes the input with InputHelper::clean(), which only encodes HTML entities and does not restrict SQL-relevant characters. The value is then concatenated directly into a raw SQL column identifier inside LeadRepository::buildQueryForGetLeadsByFieldValue(). Because Doctrine cannot parameterize identifiers, the attacker controls part of the query structure.

Critical Impact

Authenticated attackers can inject arbitrary SQL through the field parameter, enabling extraction of sensitive database contents including credentials and lead records.

Affected Products

• Mautic marketing automation platform
• LeadBundle/Controller/AjaxController.php component
• LeadRepository::buildQueryForGetLeadsByFieldValue() function

Discovery Timeline

• 2026-08-05 - CVE-2026-71245 published to NVD
• 2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71245

Vulnerability Analysis

The getLeadIdsByFieldValueAction endpoint accepts a field parameter from the HTTP request. The controller passes this value through InputHelper::clean(), which HTML-entity-encodes quotes and angle brackets. This sanitizer does not filter spaces, parentheses, commas, or other SQL syntax characters. The sanitized value flows into LeadRepository::buildQueryForGetLeadsByFieldValue(), where it is concatenated into a column reference using the pattern $col = 'l.'.$field.

Doctrine's DBAL cannot bind SQL identifiers as parameters. Column names must be validated against an allowlist or escaped through identifier-quoting APIs. Mautic performs neither check, so the attacker-controlled string becomes part of the raw query text sent to the database.

Sibling actions in the same controller enforce additional permission checks. The affected action requires only a valid session, expanding the attack surface to every authenticated account in the tenant.

Root Cause

The root cause is the direct concatenation of user-supplied input into a SQL identifier position without allowlist validation. InputHelper::clean() is designed for HTML output contexts and provides no protection against SQL injection in identifier positions.

Attack Vector

An attacker with any valid Mautic session issues a request to the vulnerable AJAX endpoint. The field parameter carries injected SQL fragments constructed to break out of the column reference and append attacker-controlled clauses. The database executes the resulting statement, returning data controlled by the injected payload.

The vulnerability manifests in the getLeadIdsByFieldValueAction handler. See the GitHub Mautic Repository for source-level technical details.

Detection Methods for CVE-2026-71245

Indicators of Compromise

• Requests to getLeadIdsByFieldValueAction containing SQL keywords such as SELECT, UNION, SLEEP, or INFORMATION_SCHEMA in the field parameter
• Unusual database query patterns referencing non-existent columns prefixed with l.
• Elevated database error rates originating from the Mautic LeadRepository component
• Authenticated user sessions issuing high volumes of AJAX requests to the Lead bundle

Detection Strategies

• Inspect web server and application logs for field parameter values containing whitespace, parentheses, or SQL syntax characters
• Deploy web application firewall rules targeting SQL injection patterns on Mautic AJAX endpoints
• Enable database query logging and alert on syntactically malformed queries originating from Mautic
• Correlate authenticated session identifiers with anomalous query volume against the leads table

Monitoring Recommendations

• Baseline normal traffic patterns to /s/ajax endpoints and alert on deviations
• Monitor for privilege escalation attempts following exploitation, including credential dumps from the users table
• Review authentication logs for newly created or dormant accounts issuing requests to the vulnerable endpoint

How to Mitigate CVE-2026-71245

Immediate Actions Required

• Upgrade Mautic to the patched release once available from the vendor
• Restrict access to the Mautic administrative interface using network-level controls
• Audit authenticated user accounts and disable those that are inactive or unnecessary
• Review database logs for evidence of prior exploitation targeting the leads table

Patch Information

Monitor the GitHub Mautic Repository for the security release addressing CVE-2026-71245. The fix should validate the field parameter against an allowlist of real column names before concatenation into SQL identifiers.

Workarounds

• Block requests to the getLeadIdsByFieldValueAction endpoint at the reverse proxy until a patch is applied
• Apply web application firewall signatures that reject SQL syntax characters in the field parameter
• Enforce least-privilege database credentials so the Mautic database user cannot access unrelated schemas

# Example nginx rule to block suspicious field parameter values
location ~ /s/ajax {
    if ($arg_field ~* "(select|union|sleep|\(|\s)") {
        return 403;
    }
}