This vulnerability affects Mautic version 7.0.0, specifically the API v2 endpoints that utilize API Platform. Under certain conditions, the enforcement of owner-scope role restrictions (e.g., 'viewown', 'editown') fails, resulting in an authorization bypass. Consequently, authenticated users with limited privileges can bypass ownership logic controls and access or modify resources belonging to other users. No patch or official remediation is currently documented for this vulnerability.

The vulnerability allows unauthorized access or modification of resources owned by other users through the API, potentially leading to data exposure or unauthorized data changes. The CVSS score of 7.1 indicates a high impact on confidentiality with limited impact on integrity and no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users only and monitor for unusual API activity. Avoid assigning owner-scope roles to untrusted users where possible.