CVE-2026-34828

CVE-2026-34828 listmonk의 비밀번호 재설정 및 변경 후 세션 유지 소개 저는 listmonk 라는 오픈소스 뉴스레터 및 메일링 리스트 관리자를 검토하면서 이 문제를 발견했습니다. 간단한 보안 질문 하나를 염두에 두고 있었죠. 사용자가 비밀번호를 변경하거나 재설정하면, 애플리케이션이 실제로 이미 발급된 세션을 종료합니까? 이 경우, 그렇지 않았습니다. 이전에 발급된 인증 세션은 다음 두 가지 경우 모두에서 유효하게 남아 있었습니다: 비밀번호 재설정 비밀번호 변경 즉, 도난당한 세션 쿠키가 사용자가 계정을 복구하...

GHSA-VFP3-V2GW-7WFQ vulnerabilities

Vulnerabilities for packages: falcosidekick-ui-fips, kube-metrics-adapter-fips, kube-metrics-adapter, falcosidekick-ui, temporal, listmonk, temporal-ui-server-fips, temporal-ui-server, temporal-fips...

GO-2025-4239 vulnerabilities

Vulnerabilities for packages: listmonk...

GO-2026-4815 vulnerabilities

Vulnerabilities for packages: rclone-fips, mattermost, mailpit-fips, seaweedfs-fips, hugo-extended, mattermost-fips, mailpit, listmonk, ollama-fips, seaweedfs, hugo-fips, ollama, seaweedfs-operator-fips, seaweedfs-operator, rclone, hugo...

GO-2026-5066 vulnerabilities

Vulnerabilities for packages: rclone-fips, mattermost, seaweedfs-fips, mattermost-fips, listmonk, seaweedfs-operator-fips, rclone, seaweedfs, seaweedfs-operator, gitlab-workhorse-ce, hugo...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-servicequotas-fips, gptscript, crossplane-provider-aws-globalaccelerator, crossplane-provider-aws-cloudwatch, crossplane-provider-azure-netapp, crossplane-provider-family-aws, vale, crossplane-provider-aws-apigatewayv2, src,...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

CVE-2026-62361

CVE-2026-62361 affects listmonk prior to version 6.2.0. The vulnerability arises in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport without calling validateQueryTables, unlike GET /api/subscribers. An authenticated user with...

CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

listmonk Admin Authentication / Password Flow Security Assessment Module

This Metasploit auxiliary module is a web application security testing tool designed to evaluate authentication and password management logic in a Listmonk admin panel deployment...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34584

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists which they don't have access to under different scenarios. This only affects multi-use...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828

CVE-2026-34828 affects listmonk, a standalone self-hosted newsletter manager. A session-management vulnerability in versions 4.1.0 up to, but not including, 6.1.0 allows already-authenticated sessions to remain valid after password reset or password change, enabling an attacker with a valid sessi...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...

CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and...