CVE-2026-9808

An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or `editown`) are not properly enforced. This allows low-privilege authenticated API users to bypass ownership-logic controls and access or modify resources belonging to other users.

• CWE-863

• https://github.com/mautic/mautic/security/advisories/GHSA-2jrw-c95w-h43g

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9801A flaw was found in Keycloak. A remote attacker with high pr…4.9
• CVE-2026-9802A flaw was found in Keycloak. When revokeRefreshToken=true i…6.8
• CVE-2026-9803A flaw was found in Keycloak's ClientRegistrationAuth compon…5.3
• CVE-2026-9804A flaw was found in KubeVirt's virt-exportserver component. …7.7
• CVE-2026-9806A stored cross-site scripting (XSS) vulnerability exists in …6.3
• CVE-2026-9807GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-9809A stored Cross-Site Scripting (XSS) vulnerability exists in …7.6
• CVE-2026-9810The AI Copilot WordPress plugin before 1.5.4 does not bind …9.8
• CVE-2026-9811A stored Cross-Site Scripting (XSS) vulnerability exists in …5.4
• CVE-2026-9813FlowIntel up to version 3.3.0 contains a server-side request…9.9
• CVE-2026-9815The MagicForm WordPress plugin through 0.1.3 does not proper…6.5
• CVE-2026-9818Rejected reason: This CVE ID has been rejected or withdrawn …