CVE-2026-9557CWE-918

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component

Medium · published May 29, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
13.1
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.1th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-29T09:38Z
EPSS history
Timeline
  • 29 MAY 09:38Z
    A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component
    cvelistv5