listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/knadh/listmonkGo | <= 1.1.0 | — |
Affected products
5- ghsa-coords4 versionspkg:golang/github.com/knadh/listmonkpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweedpkg:rpm/suse/govulncheck-vulndb&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP6
<= 1.1.0+ 3 more
- (no CPE)range: <= 1.1.0
- (no CPE)range: < 0.0.20250918T182144-150000.1.107.1
- (no CPE)range: < 0.0.20250917T170349-1.1
- (no CPE)range: < 0.0.20250918T182144-150000.1.107.1
Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-rf24-wg77-gq7wghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-58430ghsaADVISORY
- github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7wghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.