Read the docs
TI-2025-36190 Aliases CVE-2025-58430GHSA-rf24-wg77-gq7w

listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

Priority HIGH 72CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Tampering, Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352 and CWE-79.

Summary

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
knadhlistmonkup to 1.1.0—No fix listedCNA
—github.com/knadh/listmonk (Go)up to 1.1.0—No fix listedGHSA-rf24-wg77-gq7w
  • listmonk Vendorknadh Affected up to 1.1.0 Fixed in — No fix listed CNA
  • github.com/knadh/listmonk (Go) Vendor— Affected up to 1.1.0 Fixed in — No fix listed GHSA-rf24-wg77-gq7w

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*up to 1.1.0Vulnerableknadh
  • cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:* Versions up to 1.1.0 Vulnerable ·knadh

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-58430
  2. 2026-10-03 Alias added: GHSA-rf24-wg77-gq7w

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-31216 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVSS 3.1CRITICAL 9.1
  • TI-2026-27072 listmonk: Active sessions remain valid after password reset and password change CVSS 3.1HIGH 7.1
  • TI-2026-17337 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVSS 4.0MEDIUM 5.4
  • TI-2025-28914 Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers… CVSS 3.1MEDIUM 6.5
  • TI-2026-26831 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences