Server-Side Request Forgery in Mautic Affects Users with Webhook Permissions
CVE-2025-9821

2.7LOW

Key Information:

Vendor

Mautic

Status
Mautic
Vendor
CVE Published:
3 September 2025

What is CVE-2025-9821?

A vulnerability exists within Mautic that allows users with webhook permissions to exploit Server-Side Request Forgery (SSRF) via unverified webhook destinations. This weakness can potentially allow unauthorized access to internal services by bypassing firewalls. Furthermore, if users possessing these permissions can also view the webhook logs, critical information about the request responses becomes exposed, exacerbating the potential risks to the system's security.

Affected Version(s)

Mautic >= 4.4.0 <= 4.4.0

Mautic >= 5.0.0-alpha <= 5.0.0-alpha

Mautic >= 6.0.0-alpha <= 6.0.0-alpha

References

https://github.com/mautic/mautic/security/advisories/GHSA...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

asesidaa
lukehebe
patrykgruszka
kuzmany
JSON
.
CVE-2025-9821 : Server-Side Request Forgery in Mautic Affects Users with Webhook Permissions