CVE-2026-34584
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
listmonk versions 4.1.0 to before 6.1.0 have bugs in list permission checks that allow users in a multi-user environment to access lists they don't have permission to. This only affects multi-user environments with untrusted users.
Risk Assessment
Users can gain unauthorized access to sensitive mailing lists, compromising privacy and potentially leading to data leakage.
Recommendation
Update listmonk to version 6.1.0 or later, which includes the fix.
Other vulnerabilities in listmonk
See all- CVE-2026-62361Medium
Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.
- CVE-2026-34828High
listmonk from version 4.1.0 to before 6.1.0 has a session management vulnerability that allows previously issued authenticated sessions to remain valid after password reset or change. An attacker with a valid session cookie can retain access to the account even after the victim changes their password.
Original NVD description (English source)
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under different scenarios. This only affects multi-user environments with untrusted users. This issue has been patched in version 6.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS