Mautic Unauthenticated Access to Unpublished Page Previews Vulnerability

A vulnerability in Mautic allows unauthenticated users to access unpublished page previews through predictable URLs. This issue, present in versions 4.0 and later, lacked proper authorization checks, enabling unauthorized access to draft content or sensitive information. Additionally, these private preview URLs could be indexed by search engines, making the content publicly discoverable.

Impact

Exploitation of this vulnerability could lead to unauthorized access to unpublished content, including draft materials and sensitive information, with the added risk of such content being indexed by search engines and made publicly available.

Remediation

Users are advised to upgrade to Mautic versions 6.0.2, 5.2.6, or 4.4.16, where this vulnerability has been patched.