Read the docs
TI-2026-27072 Aliases CVE-2026-34828GHSA-h5j9-cvrw-v5qh

listmonk: Active sessions remain valid after password reset and password change

Priority MEDIUM 64CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed listmonk (knadh): 6.1.0github.com/knadh/listmonk (Go): 1.1.1-0.20260329113754-1b5e8d38c778

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
knadhlistmonk4.1.0 to before 6.1.06.1.0Patch availableCNA
—github.com/knadh/listmonk (Go)1.1.1-0.20241028090858-319053dd7a90 to before 1.1.1-0.20260329113754-1b5e8d38c7781.1.1-0.20260329113754-1b5e8d38c778Patch availableGHSA-h5j9-cvrw-v5qh
  • listmonk Vendorknadh Affected 4.1.0 to before 6.1.0 Fixed in 6.1.0 Patch available CNA
  • github.com/knadh/listmonk (Go) Vendor— Affected 1.1.1-0.20241028090858-319053dd7a90 to before 1.1.1-0.20260329113754-1b5e8d38c778 Fixed in 1.1.1-0.20260329113754-1b5e8d38c778 Patch available GHSA-h5j9-cvrw-v5qh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*4.1.0 to before 6.1.0Vulnerableknadh
  • cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:* Versions 4.1.0 to before 6.1.0 Vulnerable ·knadh

Remediation

  • Fix · CNA listmonk (knadh) Fixed in 6.1.0
  • Fix · GHSA-h5j9-cvrw-v5qh github.com/knadh/listmonk (Go) Fixed in 1.1.1-0.20260329113754-1b5e8d38c778 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34828
  2. 2026-10-03 Alias added: GHSA-h5j9-cvrw-v5qh

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2025-31216 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user CVSS 3.1CRITICAL 9.1
  • TI-2025-36190 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover CVSS 4.0HIGH 8.6
  • TI-2026-17337 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover CVSS 4.0MEDIUM 5.4
  • TI-2025-28914 Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers… CVSS 3.1MEDIUM 6.5
  • TI-2026-26831 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment) CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences