Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::c…

CVE-2026-71245 describes a SQL injection vulnerability in Mautic's getLeadIdsByFieldValueAction located in LeadBundle/Controller/AjaxController.php. The vulnerability arises because the 'field' request parameter is sanitized only with InputHelper::clean(), which encodes HTML entities but does not restrict SQL-relevant characters such as spaces and parentheses. The sanitized value is then concatenated directly as a raw SQL column identifier in LeadRepository::buildQueryForGetLeadsByFieldValue(), bypassing Doctrine's parameterization which cannot apply to identifiers. No whitelist validation of column names is performed. Any authenticated user with a valid session can exploit this flaw, as no additional permission checks are enforced on this action. This makes the attack surface relatively broad within a Mautic deployment. Exploitation could allow an attacker to read, manipulate, or exfiltrate data from the underlying database.