Critical · published June 9, 2025
🚨 A sneaky template function could expose your secret sauce! In listmonk, versions 4.0.0 to 5.0.1 let non-super admin users access sensitive environment variables with just a template expression. 🔥 Think of it like a restaurant where the head chef's secret recipes are written on the wall, and anyone with the right permissions can peek at them. In a multi-user kitchen, that could lead to some seriously unauthorized dishes! An attacker could easily capture sensitive environment variables, leading to potential data leakage or unauthorized access. Imagine a disgruntled employee using their access to snatch the recipes for success right out from under your nose! The consequences could be absolutely devastating for your organization.
Think of it like a restaurant where the head chef's secret recipes are written on the wall, and anyone with the right permissions can peek at them. In a multi-user kitchen, that could lead to some seriously unauthorized dishes! This vulnerability exploits the `env` and `expandenv` template functions in listmonk that, when enabled, allow users to access environment variables. It's particularly risky in multi-user installations, where non-super admins can execute the `{{ env }}` template expression to gather sensitive info.
An attacker could easily capture sensitive environment variables, leading to potential data leakage or unauthorized access. Imagine a disgruntled employee using their access to snatch the recipes for success right out from under your nose! The consequences could be absolutely devastating for your organization. Upgrade to version 5.0.2 of listmonk immediately to patch this vulnerability. Additionally, review user permissions and limit access to campaign and template features as necessary. Don't let just anyone in the kitchen! You've got this! By following these steps, you're well on your way to securing your mailing list manager. 🛡️