Authorization Flaw in Mautic's API Access Controls

CVE-2024-47053

What is CVE-2024-47053?

An authorization vulnerability exists in Mautic's API that allows any authenticated user to bypass access controls, thereby gaining unauthorized access to all reports and their associated data. This flaw undermines the intended permissions related to 'View Own' and 'View Others,' which should restrict access to sensitive report data based on user roles. Properly configured, these permissions should prevent unauthorized visibility into non-System Reports.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References