CVE-2024-47055 json
Segment cloning doesn't have a proper permission check
published 2025-05-28 17 mo ago modified 2026-06-17 4 mo ago also GHSA-vph5-ghq3-q782 , EUVD-2024-54604
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.
Insecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the cloneAction of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.
MitigationUpdate Mautic to a version that implements proper authorization checks for the cloneAction within the ListController.php. Ensure that users attempting to clone segments possess the appropriate creation permissions.
Patch / fix
- packagist mautic/core 5.2.6, 6.0.2
- Mautic Mautic < 5.2.6, < 6.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mautic/core | >=5.0.0-alpha, <5.2.6 >=6.0.0-alpha, <6.0.2 |
5.2.6 6.0.2 |
Affected products
- Mautic Mautic
Classification
References
-
github.com
/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782
web, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-47055
advisory
-
github.com
/mautic/mautic
package
Sources
- CVE List CVE-2024-47055
- GitHub Advisory GHSA-vph5-ghq3-q782
- NVD CVE-2024-47055
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.