HIGH8.1

GHSA-6x98-fx9j-7c78

Disabled users able to log in with third party SSO plugin

Quick fix

GHSA-6x98-fx9j-7c78 — mautic/core: upgrade to the fixed version with the command below.

composer require mautic/core:^2.12.0

Details

### Impact Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

### Patches Upgrade to 2.12.0 or later.

### Workarounds None.

### For more information If you have any questions or comments about this advisory: * Email us at [security@mautic.org](mailto:security@mautic.org)

Enter the version of the package you're using.

Introduced in: 2.0.0Fixed in: 2.12.0

Fixcomposer require mautic/core:^2.12.0