CVE-2025-13828CWE-862broken-access-control

CVE-2025-13828

published December 2, 2025

CVSS
9.0
EPSS
0%
Percentile
15.0
In the wild
Unconfirmed
What it is

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.

The record
Technical detail
CVSS
9.0 · NONE
CVSS v4.0
Not supplied
EPSS
0.00246 · 15.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-02T22:16Z
References (1)
https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x · [email protected]
EPSS history
Timeline
  • 02 DEC 16:54Z
    Mautic user without privileged access to the Marketplace can install and uninstall composer packages
    cvelistv5