GHSA-5r63-8h35-j3mw
Mautic insecure deserialization in segment filters and custom fields (GHSA-5r63-8h35-j3mw)
Insecure deserialization in Mautic segment filters and custom fields could allow an attacker with high privileges or write access to stored data to execute code on the server and read, modify or delete contact data. Fixed in Mautic 5.2.12, 6.0.10 and 7.2.0; no official workaround.
What happened
Mautic stores segment filter and custom field values in the database. Several code paths that read these stored values deserialize them without restricting which PHP classes may be instantiated, instead of using Mautic's safe deserialization helper. An attacker who is able to store a crafted serialized value in these properties can cause arbitrary PHP objects to be instantiated when Mautic later processes the data during segment evaluation, contact export, or custom field API requests.
Because arbitrary objects are instantiated, their magic methods run automatically. Combined with gadget chains available in Mautic's dependencies, this could allow an attacker to execute code on the server, read, modify or delete data stored in the Mautic instance including contact data, and affect availability. This is CWE-502, deserialization of untrusted data.
The GitHub advisory records no exploitation or public disclosure. Exploitation requires high privileges or an existing ability to write to the affected stored data. The CVSS 3.1 score is 8, high severity, with a network attack vector, high attack complexity, high privileges, no user interaction and changed scope.
Who is affected
Affected are Mautic installations on 2.15.2 up to but not including 5.2.12, 6.0.0 up to but not including 6.0.10, and 7.0.0 up to but not including 7.2.0. The flaw concerns installations where segment filters and custom field properties are stored and later processed, including those using contact export or custom field API requests. Fixed builds are Mautic 5.2.12, 6.0.10 and 7.2.0. Mautic's advisory refers legacy Mautic 4 users to the Extended Long-Term Support page.
What to do now
- Upgrade to the fixed release for the branch you run: Mautic 5.2.12, 6.0.10 or 7.2.0.
- If you cannot upgrade immediately, Mautic states there are no official workarounds. Reduce risk by restricting administrative access, including permissions to manage segments and custom fields, and API access, to trusted users.
- Ensure no untrusted party has write access to the Mautic database.
- Treat unexpected changes to segment filters or custom fields as suspicious and review privileged account activity.
How to detect it
Mautic's advisory does not provide indicators of compromise. Review administrative and API changes to segment filters and custom fields, and audit who can write to the Mautic database. Because exploitation requires high privileges, unexpected modifications made by privileged accounts deserve particular review.
Beyond the patch
Beyond the patch, this advisory is a reminder that deserialization flaws usually become serious only after a privileged account or database write path is already compromised. An Implementation & Assessment Services review can confirm how many people can modify segment filters and custom fields and whether your hardened state resists this class of weakness. Managed Detection & Response (MDR) gives you the detection trail if privileged credentials are abused, and Supply Chain Defense & Third-Party Risk helps you track Mautic's fix cadence across every instance you run.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Mautic | 2.15.2 – < 5.2.12 6.0.0 – < 6.0.10 7.0.0 – < 7.2.0 | 5.2.12 6.0.10 7.2.0 , 6.0.10, 7.2.0 |