SQL Injection Vulnerability in Mautic Contact Activity API

CVE-2026-3105

What is CVE-2026-3105?

An SQL injection vulnerability has been found in the API endpoint for retrieving contact activities in Mautic. The vulnerability arises from inadequate validation of a parameter used for determining the sort direction in query construction. This oversight allows authenticated users to potentially execute arbitrary SQL commands via the API, which could lead to unauthorized access or manipulation of the database. It is crucial for users to update their software to versions 4.4.19, 5.2.10, 6.0.8, 7.0.1, or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References