CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...