CVE-2026-3105

published 2026-02-24

CVE-2026-3105: SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query…

Priority P2 61 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity timeline where the parameter responsible for determining the sort direction was not strictly validated against an allowlist, potentially allowing authenticated users to inject arbitrary SQL commands via the API.

MitigationPlease update to 4.4.19, 5.2.10, 6.0.8, 7.0.1 or later.

WorkaroundsNone.

ReferencesIf you have any questions or comments about this advisory:

Email us at [email protected]

Affected

8 ranges

Vendor	Product	Version range	Fixed in
acquia	mautic	>= 2.10.0 < 4.4.19	4.4.19
acquia	mautic	>= 5.0.0 < 5.2.10	5.2.10
acquia	mautic	>= 6.0.0 < 6.0.8	6.0.8
acquia	mautic	>= 7.0.0 < 7.0.1	7.0.1
mautic	core	>= 2.10.0 < 5.2.10	5.2.10
mautic	core	>= 6.0.0-alpha < 6.0.8	6.0.8
mautic	core	>= 7.0.0-alpha < 7.0.1	7.0.1
mautic	mautic	>= >= 2.10.0 < < 4.4.19 <5.2.10 <6.0.8 <7.0.1	< 4.4.19 <5.2.10 <6.0.8 <7.0.1

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerable parameter controls sort direction in the Contact Activity timeline API endpoint — monitor API requests where the sort direction parameter contains SQL metacharacters or keywords (e.g., values other than 'ASC'/'DESC') as evidence of injection attempts. ↗
• → Focus detection on the Contact Activity timeline API endpoint in Mautic (mautic/core). Authenticated requests to this endpoint with anomalous sort-direction parameter values should be flagged. ↗

• · Exploitation requires authentication; unauthenticated users cannot trigger this SQL injection. ↗
• · Affected package is mautic/core. Fixed versions are 4.4.19, 5.2.10, 6.0.8, and 7.0.1 or later. No workarounds are available. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89