Threats tagged 'ghsa-xgjr-7j9q-2h4r'

A SQL injection vulnerability in listmonk's GET /api/subscribers/export endpoint allows authenticated users with the subscribers:sql_query permission to bypass table access controls and read arbitrary database tables, including sensitive ones like users and settings. This enables exfiltration of bcrypt password hashes and SMTP credentials. The vulnerability also permits execution of data-modifying SQL statements via PostgreSQL CTEs. An attacker can escalate privileges by cracking extracted bcrypt hashes to take over Super Admin accounts. The flaw is fixed in version 1.1.1-0.20260619102436-c0a6525009a6.