An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-sc…

An authorization bypass vulnerability in Mautic 7 API v2 endpoints allows low-privilege authenticated users to bypass ownership controls. The vulnerability affects roles with owner-scope restrictions like viewown and editown permissions. Attackers can access or modify resources belonging to other users by exploiting improperly enforced ownership-logic controls in the API Platform implementation.