Threat Intelligence Database

A SQL injection vulnerability exists in listmonk prior to version 6.2.0 in the GET /api/subscribers/export endpoint. This endpoint improperly injects a user-controlled query parameter into an internal function without proper validation, allowing an authenticated user with specific privileges to read arbitrary database tables and execute data-modifying PostgreSQL common table expressions (CTEs). The issue is fixed in version 6.2.0.

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.

A vulnerability in listmonk versions 4.1.0 up to but not including 6.1.0 allows users in multi-user environments with untrusted users to bypass authorization checks and access mailing lists they should not have access to. This issue arises from bugs in list permission checks. The vulnerability has been patched in version 6.1.0. It has a medium severity with a CVSS score of 5.

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.

MediumVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2026-21483#cwe-79

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a problem on single-user (super admin) installations, on multi-user installations, this allows non-super-admin users with campaign or template permissions to use the `{{ env }}` template expression to capture sensitive environment variables. Users should upgrade to v5.0.2 to mitigate the issue.

CriticalVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-49136#cwe-1336

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-46011