CVE-2026-71245

Mautic's getLeadIdsByFieldValueAction is vulnerable due to insufficient sanitization of user input, allowing an attacker to inject SQL through the field name parameter, which is directly concatenated into a SQL query without proper validation. This vulnerability can lead to unauthorized data access or manipulation, posing a significant risk to the integrity of the database. Organizations using Mautic should prioritize addressing this issue, especially those with authenticated user access, to prevent potential exploitation.