CVE-2017-1000489

Mautic versions 2.0.0 – 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

Source: CVE-2017-1000489