Threats tagged 'ghsa-3x76-6c5v-3x8x'

listmonk versions 6.2.0 up to but not including 7.0.0-beta.2 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to submit forged Azure Event Grid bounce webhook events when no shared secret is configured. Attackers can send POST requests with EmailDeliveryReportReceived events marked as Bounced to the /webhooks/service/azure endpoint, enabling them to blocklist, unsubscribe, or delete arbitrary subscribers without authorization.