Server-Side Request Forgery Vulnerability in Mautic's Focus Component
CVE-2026-9557

6.4MEDIUM

Key Information:

Status
Vendor
CVE Published:
29 May 2026

What is CVE-2026-9557?

A vulnerability exists in Mautic's Focus component that allows an authenticated user to exploit insufficient validation of user-supplied URLs. This can lead to unauthorized outbound HTTP requests from the hosting server, posing risks such as internal network reconnaissance or directing requests to arbitrary external or internal endpoints. Proper filtering and validation mechanisms are essential to mitigate this risk associated with the Focus component.

References

https://github.com/mautic/mautic/security/advisories/GHSA...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mateus (@r1beirin)
Nguyen Huy Vu Dung (@dungNHVhust)
Patryk Gruszka (@patrykgruszka)
John Linhart (@escopecz)
Leuchtfeuer Digital Marketing (@Leuchtfeuer)
.