CVE-2026-9809: A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7

Synopsis

A stored cross-site scripting (XSS) flaw exists in the Projects component of Mautic 7, where project names are rendered in administrative tag popovers without proper sanitization. An authenticated user with project edit rights can inject JavaScript that runs in an administrator's browser when they hover over the tag, letting the attacker act as the admin, change configurations, or exfiltrate sensitive data. A patched-image rebuild at Mautic 7.1.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Mautic administrative interface over the network.

• AuthenticationRequired

  A low-privilege account with permission to create or edit projects is sufficient.

• Victim interactionRequired

  An administrator must view an associated entity and hover over the malicious project tag to trigger the script.

• Attack complexityDetail

  Attack complexity is low: the payload fires reliably once an admin hovers the tag, with no race or environmental conditions.

Blast Radius

• Executes arbitrary JavaScript in an authenticated administrator's browser session against the Mautic admin UI.
• Performs administrative actions on behalf of the victim, including altering system configurations and managing campaigns, emails, or forms.
• Reads sensitive data visible to the admin session and exfiltrates it to an attacker-controlled endpoint.
• Pivots across the scope boundary into other components rendered alongside the vulnerable popover.