Listmonk CVE-2026-34584

The CVSS score of 5.4 reflects a moderate severity vulnerability with a network attack vector, low complexity, and requirement for low-privilege authentication (PR:L). The attack results in confidentiality and integrity impacts (accessing and potentially modifying lists) without availability impact. The CVSS metrics align with the described threat: this is not a high-impact vulnerability in absolute terms, but it represents a meaningful breach of data segregation within multi-user systems. The actual risk is materially constrained to multi-user, self-hosted deployments with untrusted users; single-user or fully-trusted environments face negligible risk. The presence of a patched version (6.1.0) released by the vendor and upstream commit references demonstrates vendor responsiveness. No public exploit code or CISA KEV status has been identified, indicating no confirmed active exploitation. Organizations running Listmonk in isolated, single-user, or internally-trusted-only scenarios can deprioritize; those running true multi-tenant or adversarial-user deployments should patch promptly to restore proper isolation.

In a multi-user Listmonk instance shared by multiple organizations or teams, an authenticated user (e.g., a newsletter curator for Team A) could exploit flawed permission checks to directly access, view, modify, or delete mailing lists belonging to Team B. For example, the attacker might craft an HTTP request targeting a list ID they do not own, and the application would fail to enforce the authorization check, granting access. This could lead to unauthorized viewing of subscriber data, modification of list content, or disruption of campaigns managed by other users. No public proof-of-concept code has been identified as of the analysis date.