CVE-2026-34828
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
listmonk from version 4.1.0 to before 6.1.0 has a session management vulnerability that allows previously issued authenticated sessions to remain valid after password reset or change. An attacker with a valid session cookie can retain access to the account even after the victim changes their password.
Risk Assessment
An attacker can maintain unauthorized access to the victim's account after a password change, weakening account recovery and session security.
Recommendation
Upgrade listmonk to version 6.1.0 or later.
Other vulnerabilities in listmonk
See all- CVE-2026-62361Medium
Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.
- CVE-2026-34584Medium
listmonk versions 4.1.0 to before 6.1.0 have bugs in list permission checks that allow users in a multi-user environment to access lists they don't have permission to. This only affects multi-user environments with untrusted users.
Original NVD description (English source)
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.