CVE-2026-34584CWE-639

listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)

Medium · published April 2, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under different scenarios. This only affects multi-user environments with untrusted users. This issue has been patched in version 6.1.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-04-02T17:31Z
EPSS history
Timeline
  • 02 APR 17:31Z
    listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)
    cvelistv5