CVE-2026-62361 · GHSA-xgjr-7j9q-2h4r

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Risk score: 42/100
CVSS: 5.5 v3.1
Exploit chance (30 days): 0.3%
Published: 15 Jul 2026

Open in the live forecast Today's forecast

What to know

What it is: listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowi…
Affected: github.com/knadh/listmonk (go) < 1.1.1-0.20260619102436-c0a6525009a6
Fix: Upgrade github.com/knadh/listmonk to 1.1.1-0.20260619102436-c0a6525009a6 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 5.5 medium
On your watchlist: Go

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
github.com/knadh/listmonk	go	< 1.1.1-0.20260619102436-c0a6525009a6	1.1.1-0.20260619102436-c0a6525009a6

References

Original description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.

Last activity 6 Nov 2026. Patch Forecast updates every hour.