CVE-2026-73482 is a CSRF vulnerability in phpList versions before 3.7.0-RC5 affecting the lists/admin/admins.php script. The vulnerability occurs because the administrator deletion action can be triggered through an unauthenticated GET request (?page=admins&delete=N) without requiring a valid CSRF token. The central verifyCsrfGetToken check is bypassed due to enforce=false and absence of the token parameter, enabling an attacker to cause a logged-in super-administrator to delete other administrator accounts by tricking them into visiting a crafted URL.

An attacker can cause a logged-in super-administrator to unintentionally delete any administrator account other than their own. This could lead to loss of administrative control or disruption of management capabilities within the phpList system. The vulnerability requires the victim to be authenticated and to interact with a maliciously crafted URL, such as one embedded in an email.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged into phpList. Implementing additional CSRF protections or restricting administrator actions to POST requests may help mitigate risk.