CVE-2026-34828

HIGH EPSS 21.6%
Published Apr 2, 20262mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Apr 2, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.

CVSS Details

Base Score
7.1
Exploitability
2.8
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
21.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-613

Affected Products 1

VendorProductVersionRange
nadhlistmonk*≥4.1.0  –  <6.1.0

References 3

  • github.com https://github.com/knadh/listmonk/commit/db82035d619348949512dafdaf60c86037cafc9e
    Patch
  • github.com https://github.com/knadh/listmonk/releases/tag/v6.1.0
    ProductRelease Notes
  • github.com https://github.com/knadh/listmonk/security/advisories/GHSA-h5j9-cvrw-v5qh
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/knadh/listmonk/commit/db82035d619348949512dafdaf60c86037cafc9e
    Patch