{"id":"GHSA-vph5-ghq3-q782","aliases":["CVE-2024-47055"],"title":"Mautic segment cloning doesn't have a proper permission check","description":"### Summary\nThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper authorization checks.\n\nInsecure Direct Object Reference (IDOR) / Missing Authorization: A missing authorization vulnerability exists in the `cloneAction` of the segment management. This allows an authenticated user to bypass intended permission restrictions and clone segments even if they lack the necessary permissions to create new ones.\n\n### Mitigation\nUpdate Mautic to a version that implements proper authorization checks for the `cloneAction` within the `ListController.php`. Ensure that users attempting to clone segments possess the appropriate creation permissions.\n\n### Workarounds\nNone\n\nIf you have any questions or comments about this advisory:\nEmail us at security@mautic.org","severity":"medium","score":4.3,"published":"2025-05-28T17:38:58.000Z","modified":"2025-05-28T20:46:26.191Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"mautic/core","ranges":[{"events":[{"introduced":"5.0.0-alpha"},{"fixed":"5.2.6"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.0-alpha","5.0.0-alpha1","5.0.0-beta1","5.0.0-beta2","5.0.0-rc1","5.0.0-rc2","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.1","5.2.0","5.2.1","5.2.2","5.2.3","5.2.4","5.2.5"],"fixed":["5.2.6"]},{"ecosystem":"Packagist","name":"mautic/core","ranges":[{"events":[{"introduced":"6.0.0-alpha"},{"fixed":"6.0.2"}],"type":"ECOSYSTEM"}],"versions":["6.0.0","6.0.0-alpha","6.0.0-beta2","6.0.0-rc","6.0.1"],"fixed":["6.0.2"]}],"references":["https://github.com/mautic/mautic/security/advisories/GHSA-vph5-ghq3-q782","https://nvd.nist.gov/vuln/detail/CVE-2024-47055","https://github.com/mautic/mautic"],"sources":[{"name":"OSV","id":"GHSA-vph5-ghq3-q782","modified":"2025-05-28T20:46:26.191298Z","url":"https://osv.dev/vulnerability/GHSA-vph5-ghq3-q782"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","score":4.3}]}