CVE-2026-34584

MEDIUM

listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)

Title source: cna

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under different scenarios. This only affects multi-user environments with untrusted users. This issue has been patched in version 6.1.0.

References (3)

[X_Refsource_Confirm] https://github.com/knadh/listmonk/security/advisories/GHSA-85j8-5c6w-gcpv

[X_Refsource_Misc] https://github.com/knadh/listmonk/commit/347f5976759232c36e571cf58b4bfe33c2794f35

View Writeup ZIP pw:eip

[X_Refsource_Misc] https://github.com/knadh/listmonk/releases/tag/v6.1.0

Scores

CVSS v3 5.4

EPSS 0.0003

EPSS Percentile 8.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-639

Status published

Products (2)

knadh/listmonk >= 4.1.0, < 6.1.0

nadh/listmonk 4.1.0 - 6.1.0

Published Apr 02, 2026

Tracked Since Apr 02, 2026