This vulnerability involves improper neutralization of special elements used in SQL commands (CWE-89) within Mautic's API contact filtering. Specifically, nested query parameters are not recursively sanitized, enabling an authenticated API user to inject arbitrary SQL commands by bypassing input filtering. The issue affects several released versions of Mautic and has been assigned CVE-2026-4776. The CVSS 3.1 base score is 7.1, reflecting a high-severity vulnerability with network attack vector, low attack complexity, and requiring privileges but no user interaction. The impact is primarily on confidentiality, with no integrity or availability impact noted.

An authenticated API user can exploit this vulnerability to inject arbitrary SQL commands, potentially leading to unauthorized disclosure of sensitive data stored in the database. The CVSS vector indicates a high impact on confidentiality, with limited impact on availability and no impact on integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, it is recommended to restrict API access to trusted users only and monitor for unusual API activity. Avoid exposing the vulnerable API endpoints publicly until a patch is released.