CVE-2026-9809: XSS
Summary A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads.
Impact When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.
Patched Versions This security issue has been addressed in the following release: 7.1.2
Note: Mautic 6.x, 5.x, and 4.x branches do not contain the Projects feature and are not affected by this vulnerability. For general security support regarding legacy Mautic 4 releases, please refer to the ELTS page.
Workarounds There are no official workarounds. To mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.
Other sources
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mautic/coreto a version that resolves this vulnerability.Fixed in 7.1.2 - Upgrade
Upgrade
mauticto a version that resolves this vulnerability.Fixed in 7.1.2 - Compensating control
Mitigate the stored XSS in Mautic 7 by restricting project creation and modification permissions to trusted administrative users (no official workarounds other than permission restriction).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9809?
The severity of CVE-2026-9809 is rated high with a score of 7.6.
What type of vulnerability is associated with CVE-2026-9809?
CVE-2026-9809 is a stored Cross-Site Scripting (XSS) vulnerability.
How does CVE-2026-9809 affect Mautic users?
CVE-2026-9809 affects Mautic users by allowing an authenticated user to execute unauthorized scripts via unsanitized project names.
What components of Mautic are impacted by CVE-2026-9809?
CVE-2026-9809 impacts the Projects component of Mautic, particularly in administrative detail views.
How can I mitigate the risk of CVE-2026-9809?
To mitigate the risk of CVE-2026-9809, ensure that proper input sanitization is implemented for user-supplied project names.