CVE-2026-73482 is a CSRF vulnerability in phpList3 affecting versions before 3.7.0-RC5. The vulnerability exists in lists/admin/admins.php where the administrator deletion action can be triggered via an unauthenticated GET request without a valid CSRF token. The central CSRF verification mechanism is bypassed because the token check uses enforce=false and is skipped if the token parameter is missing. This enables a remote attacker to cause a logged-in super-administrator to unknowingly delete other administrator accounts by visiting a maliciously crafted URL, such as one embedded in an email.

An attacker can cause a logged-in super-administrator to delete any other administrator account except themselves without their consent. This could lead to loss of administrative control or disruption of administrative functions within phpList3 installations running affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking on untrusted links while logged in. Implementing additional CSRF protections or disabling administrator deletion via GET requests may help mitigate risk.