This vulnerability in Mautic 7.0.0 affects the API v2 endpoints that use API Platform. Roles configured with owner-scope restrictions are not correctly enforced, enabling low-privilege authenticated API users to bypass ownership logic and access or modify resources owned by others. The issue is categorized under CWE-863 (Incorrect Authorization). The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level has been published by the vendor as of the vulnerability publication date.

The vulnerability allows unauthorized access or modification of resources belonging to other users by bypassing ownership-based authorization controls. This can lead to exposure of sensitive data (high confidentiality impact) and unauthorized changes (low integrity impact) within the affected Mautic instance. There is no impact on availability. The vulnerability requires an authenticated attacker with low privileges and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict API access to trusted users and monitor for unusual access patterns. Avoid assigning owner-scope roles to untrusted users. Follow vendor channels for updates on patches or mitigations.