CVE-2025-9823: Mautic >= 4.4.0 to before < 4.4.17, >= 5.0.0-alpha to before < 5.2.8, >= 6.0.0-alpha to before < 6.0.5

Affected technology

Mautic · >= 4.4.0 to before < 4.4.17, >= 5.0.0-alpha to before < 5.2.8, >= 6.0.0-alpha to before < 6.0.5
Mautic

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Active user interaction

What an attacker can do

An attacker can execute arbitrary JavaScript in the context of another user’s session. Vendor/CNA’s CVSS 4.0 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.