{"id":"EUVD-2026-44815","enisaUuid":"222a15b9-c8c5-3890-9297-2c31be78d15e","description":"listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials","datePublished":"Nov 6, 2026, 6:15:17 PM","dateUpdated":"Nov 6, 2026, 6:15:17 PM","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r\nhttps://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024\nhttps://github.com/knadh/listmonk/releases/tag/v6.2.0\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62361\n","aliases":"CVE-2026-62361\nGHSA-xgjr-7j9q-2h4r\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"de79bbbe-f438-3fe8-8294-8190fffa6366","product":{"name":"listmonk","vendor":{"name":"knadh"}},"product_version":"\u003c 6.2.0"}],"enisaIdVendor":[{"id":"6359375c-67ea-3191-8fa7-cb8a22e43ef5","vendor":{"name":"knadh"}}],"enisaIdVulnerability":[{"id":"9c3e727f-2670-3215-9718-a8bb4770928b","vulnerability":{"id":"GHSA-xgjr-7j9q-2h4r","description":"listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials","datePublished":"Nov 6, 2026, 6:15:17 PM","dateUpdated":"Nov 6, 2026, 6:15:17 PM","baseScore":0.0,"references":"https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62361\nhttps://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024\nhttps://github.com/knadh/listmonk\nhttps://github.com/knadh/listmonk/releases/tag/v6.2.0\n","enisa_id":"EUVD-2026-44815\n","aliases":"GHSA-xgjr-7j9q-2h4r\nCVE-2026-62361\n","epss":0.0,"dataProcessed":"Nov 6, 2026, 9:01:31 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"ae9f4006-acd6-304d-9cae-67596093194e","vulnerability":{"id":"CVE-2026-62361","description":"listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.","datePublished":"Jul 15, 2026, 8:56:45 PM","dateUpdated":"Jul 16, 2026, 3:12:24 PM","status":"PUBLISHED","baseScore":5.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r\nhttps://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024\nhttps://github.com/knadh/listmonk/releases/tag/v6.2.0\n","enisa_id":"EUVD-2026-44815\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 6, 2026, 7:15:43 AM","vulnerabilityProduct":[{"id":"b22e3a68-8034-3412-ad2d-a659eed1874c","product":{"name":"listmonk","vendor":{"name":"knadh"}},"product_version":"\u003c 6.2.0"}],"vulnerabilityVendor":[{"id":"da387c89-b7fd-39d2-99b2-5cf522c5f9ef","vendor":{"name":"knadh"}}]}}],"enisaIdAdvisory":[]}