CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

• CWE-863

• https://github.com/mautic/mautic/security/advisories/GHSA-2jrw-c95w-h43g

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98074In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98075In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98076In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98077In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98078In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98079In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98080In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98081In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98082In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98083In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-98084In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98085In the Linux kernel, the following vulnerability has been re…