CVE-2025-58430
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie 'session' there included 'nonce'. The value is not checked and validated by the backend, removing 'nonce' allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
Risk Assessment
The risk is that the lack of nonce validation can be chained with other vulnerabilities, potentially leading to admin account takeover and system integrity compromise.
Recommendation
Monitor listmonk updates and apply patches when available. In the meantime, restrict access to the admin panel and implement additional protections such as strong authentication.
Other vulnerabilities in listmonk
See all- CVE-2026-62361Medium
Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.
- CVE-2026-34828High
listmonk from version 4.1.0 to before 6.1.0 has a session management vulnerability that allows previously issued authenticated sessions to remain valid after password reset or change. An attacker with a valid session cookie can retain access to the account even after the victim changes their password.
- CVE-2026-34584Medium
listmonk versions 4.1.0 to before 6.1.0 have bugs in list permission checks that allow users in a multi-user environment to access lists they don't have permission to. This only affects multi-user environments with untrusted users.
Original NVD description (English source)
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS