CVE-2025-13828
NoneCVSS
—
EPSS
0.2%
Published
Dec 2, 2025
CISA due date
—
The record
SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | mautic/core | 4.0.0 | 4.4.18 |
| Packagist | mautic/core | 5.0.0 | 5.2.9 |
| Packagist | mautic/core | 6.0.0 | 6.0.7 |
| packagist | mautic/core | 4.0.0 | 4.4.18 |
| packagist | mautic/core | 5.0.0 | 5.2.9 |
| packagist | mautic/core | 6.0.0 | 6.0.7 |
Related vulnerabilities
- GHSA-r5j5-q42h-fc93 Mautic is Vulnerable to SQL Injection through Contact Activity API Sorting Also affects mautic/core
- CVE-2026-3105 SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for… Also affects mautic/core
- CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. CWE-862
- CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. CWE-862
- CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing. CWE-862
- CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful… CWE-862
- CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful… CWE-862
- CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful… CWE-862