Authorization Flaw in Mautic's API Access Controls

CVE-2024-47053

Summary

An authorization vulnerability exists in Mautic's API that allows any authenticated user to bypass access controls, thereby gaining unauthorized access to all reports and their associated data. This flaw undermines the intended permissions related to 'View Own' and 'View Others,' which should restrict access to sensitive report data based on user roles. Properly configured, these permissions should prevent unauthorized visibility into non-System Reports.

References