CVE-2026-9811: Stored XSS in Mautic 7 Project Selector—Vulnerability Guide

Technical summary

The vulnerability stems from insufficient output encoding in the project selector's AJAX-powered dropdown rendering. Mautic 7 retrieves project names via AJAX and inserts them directly into DOM option elements without sanitization. An attacker authenticated with project creation privileges can craft a project name containing script tags or event handlers (e.g., <img src=x onerror='malicious code'>). When another user with administrative privileges renders an entity editor containing the project selector, the unsanitized project name is parsed as HTML, and the embedded script executes within the admin's authenticated session context. This is classified as stored XSS because the payload persists in the database and triggers every time an admin interacts with that project selector.

Business impact

A successful exploit could compromise administrative user sessions, enabling attackers to perform unauthorized actions such as modifying system configurations, extracting organizational data from the Mautic dashboard, or creating backdoor user accounts. The attack chain requires two separate user actions (attacker creates a malicious project; admin later opens an editor), but the stored nature means the threat remains persistent until the malicious project is deleted. For organizations using Mautic for marketing automation and CRM functions, compromised admin accounts could lead to unauthorized customer data access, campaign manipulation, or credential harvesting.

Affected systems

Mautic version 7 is confirmed affected. The project selector component is a core UI element used whenever administrators associate projects with entities (campaigns, leads, segments, or other system objects), making the exposure broad across typical Mautic deployments. Older Mautic versions may have different implementations; confirmation of affected versions beyond 7 requires consultation of vendor advisories. All instances are vulnerable regardless of deployment model (self-hosted or SaaS) if running the affected version.

Exploitability

Exploitation requires valid authentication (attacker must be a Mautic user) and permissions to create projects—a privilege typically granted to marketing managers or system administrators in standard Mautic setups. However, the barrier is moderate; many organizations grant broad project creation rights. The actual trigger requires a secondary action: an administrative user must open an entity editor containing the malicious project in the dropdown. This UI-driven interaction is not guaranteed, but in active Mautic environments where admins regularly manage projects and entities, the likelihood is reasonable. No special network access or complex attack techniques are needed beyond basic XSS payload crafting. The CVSS score of 5.4 (MEDIUM) reflects the requirement for authentication and user interaction, offset by the high potential for session hijacking or privilege abuse.

Remediation

Organizations must update Mautic to a patched version as soon as it becomes available from the vendor. As an interim control, restrict project creation permissions to a minimal set of trusted administrators, and review existing project names for suspicious content (unusual characters, script-like syntax). Educate administrative staff to avoid clicking unfamiliar project names or entity editors from untrusted sources. Web application firewalls (WAF) configured to block reflected/stored XSS patterns in project names may provide temporary mitigation, though this is not a substitute for patching.

Patch guidance

Watch for a Mautic security update addressing CVE-2026-9811. Verify the specific patched version number in the official Mautic security advisory before deployment. Patch testing should include verification that project selectors correctly render previously created projects without executing any stored payloads. Automated regression testing of the AJAX project dropdown functionality is recommended. Apply patches to all instances (development, staging, production) in a coordinated rollout to avoid introducing inconsistencies.

Detection guidance

Monitor Mautic application logs and database audit trails for project creation events containing unusual characters, HTML tags, or event handler syntax (e.g., 'onerror=', 'onclick=', '<script'). Correlate these with subsequent entity editor access by high-privilege accounts. Web application firewalls or intrusion detection systems can flag HTTP requests with XSS signatures in project name parameters. Consider periodic security scanning of Mautic project tables using data loss prevention (DLP) or content inspection tools. Inspect browser console errors or JavaScript execution logs on admin workstations for unexpected script execution tied to project selector interactions.

Why prioritize this

Although ranked as MEDIUM severity, this vulnerability merits prompt attention due to the privileged nature of affected users (admins) and the persistent, stored attack vector. Unlike reflected XSS, stored XSS can lie dormant and compromise multiple admin sessions over time. The combination of session hijacking potential and organizational data access risk elevates practical impact. Prioritize patching in environments where Mautic handles sensitive customer data or is tightly integrated with identity systems. It is not yet listed in the Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation is not currently documented, but the straightforward exploitation path warrants treating it as a likely future target.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects: Network-based attack vector (AV:N), Low attack complexity (AC:L), requirement for Low privilege level (PR:L—authenticated user status), and user interaction needed (UI:R—admin must open the editor). The impact scope is changed (S:C) because the script executes in an administrative context with broader system access than the project creator. Confidentiality and integrity are degraded (C:L, I:L) due to potential session hijacking and unauthorized actions, but availability is not impacted (A:N). Organizations handling high-value data should treat this as a priority despite the MEDIUM label.

Frequently asked questions