EUVD-2026-44815Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Endpoint is network-reachable but requires two specific high-privilege permissions (PR:H); arbitrary table reads yield full confidentiality loss; CTE-based DML enables partial writes (I:L); no availability impact described.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.
AnalysisAI
SQL injection in listmonk's subscriber export endpoint prior to version 6.2.0 allows a highly-privileged authenticated user to read arbitrary PostgreSQL database tables - including users and settings - and execute data-modifying CTEs. The GET /api/subscribers/export endpoint passed a user-controlled query parameter directly into QuerySubscribersForExport in internal/core/subscribers.go without invoking the validateQueryTables guard that the sibling GET /api/subscribers endpoint correctly applies, creating a bypass of the allowlist-based table restriction. Exploitation requires possession of both the subscribers:sql_query and subscribers:get_all permissions; no public exploit code has been identified at time of analysis.
Technical ContextAI
listmonk is a self-hosted Go-based newsletter and mailing list manager backed by PostgreSQL (CPE: cpe:2.3:a:knadh:listmonk:*:*:*:*:*:*:*:*). The flaw falls under CWE-89 (SQL Injection): the application's ExportSubscribers function in internal/core/subscribers.go accepted a user-supplied SQL expression and injected it into a PostgreSQL query without first calling validateQueryTables, which uses EXPLAIN (FORMAT JSON) to inspect the query plan and enforce an allowlist of permitted tables (subscribers, lists, subscriber_lists, campaigns, campaign_lists, campaign_views, links, link_clicks, bounces). The fix in commit c0a6525009a65265230185f16e8674dcc83aa024 inserts the missing validateQueryTables call into ExportSubscribers and simultaneously corrects the function's signature to pass bound query arguments into the EXPLAIN validation, preventing the guard from running against incorrect parameters. Because PostgreSQL supports data-modifying CTEs (WITH ... AS INSERT/UPDATE/DELETE), the injection surface allows not just data reads but also writes, making the Integrity impact concrete despite the endpoint's read-oriented purpose.
RemediationAI
Upgrade listmonk to version 6.2.0 or later, which resolves the vulnerability via the fix in commit c0a6525009a65265230185f16e8674dcc83aa024; the release is available at https://github.com/knadh/listmonk/releases/tag/v6.2.0 and the advisory is at https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r. For deployments that cannot immediately upgrade, the most effective compensating control is revoking the subscribers:sql_query permission from all non-essential accounts, since this permission is a mandatory prerequisite for exploitation; the trade-off is that custom SQL filtering features will be unavailable to those accounts. Alternatively, a reverse proxy rule blocking or restricting access to GET /api/subscribers/export at the network perimeter can prevent exploitation without affecting other API functions, at the cost of disabling subscriber export for all users. Neither workaround eliminates the underlying flaw and both should be treated as temporary bridges to the v6.2.0 upgrade.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today