CVE-2025-9822

SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w

Configurations

No configuration.

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) ResumenUn usuario con derechos de administrador puede cambiar la configuración de la aplicación mautic y extraer secretos que normalmente no están disponibles. ImpactoUn administrador que normalmente no tiene acceso a ciertos parámetros, como las credenciales de la base de datos, puede revelarlos.

Information

Published : 2025-09-03 14:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-9822

Mitre link : CVE-2025-9822

CVE.ORG link : CVE-2025-9822

JSON object : View

Products Affected

No product.

CWE

CWE-283

Unverified Ownership

{"id": "CVE-2025-9822", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9822", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-03T14:08:49.982448Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@mautic.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@mautic.org", "affectedData": [{"repo": "https://github.com/mautic/mautic", "vendor": "Mautic", "product": "Mautic", "versions": [{"status": "affected", "version": ">= 4.4.0", "lessThan": "< 4.4.17", "versionType": "semver"}, {"status": "affected", "version": ">= 5.0.0-alpha", "lessThan": "< 5.2.8", "versionType": "semver"}, {"status": "affected", "version": ">= 6.0.0-alpha", "lessThan": "< 6.0.5", "versionType": "semver"}], "packageName": "mautic/core", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2025-09-03T14:15:46.247", "references": [{"url": "https://github.com/mautic/mautic/security/advisories/GHSA-438m-6mhw-hq5w", "source": "security@mautic.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@mautic.org", "description": [{"lang": "en", "value": "CWE-283"}]}], "descriptions": [{"lang": "en", "value": "SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available.\n\nImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them."}, {"lang": "es", "value": "ResumenUn usuario con derechos de administrador puede cambiar la configuraci\u00f3n de la aplicaci\u00f3n mautic y extraer secretos que normalmente no est\u00e1n disponibles.\n\nImpactoUn administrador que normalmente no tiene acceso a ciertos par\u00e1metros, como las credenciales de la base de datos, puede revelarlos."}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "security@mautic.org"}