High severity7.1NVD Advisory· Published Apr 2, 2026· Updated Apr 15, 2026
CVE-2026-34828
CVE-2026-34828
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/knadh/listmonkGo | >= 1.1.1-0.20241028090858-319053dd7a90, < 1.1.1-0.20260329113754-1b5e8d38c778 | 1.1.1-0.20260329113754-1b5e8d38c778 |
Affected products
2- ghsa-coordsRange: >= 1.1.1-0.20241028090858-319053dd7a90, < 1.1.1-0.20260329113754-1b5e8d38c778
Patches
Vulnerability mechanics
References
5- github.com/knadh/listmonk/commit/db82035d619348949512dafdaf60c86037cafc9envdPatchWEB
- github.com/knadh/listmonk/security/advisories/GHSA-h5j9-cvrw-v5qhnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-h5j9-cvrw-v5qhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-34828ghsaADVISORY
- github.com/knadh/listmonk/releases/tag/v6.1.0nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.