Auth bypass in Mautic

CVE-2025-13828

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

Vulnerability class: Broken Access Control

EPSS: 0.002 (12.6th percentile) — read the EPSS interpretation.

Affected products

  • Mautic — versions <4.4.18, <5.2.9, <6.0.7

Weakness classification (CWE)

References