CVE-2026-34828: fallo de gravedad alta en knadh listmonk
listmonk: Active sessions remain valid after password reset and password change
Publicada el · Actualizada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
probabilidad de explotación
0.4%top 71% de las CVE
explotación observada
noninguna fuente lo reporta
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Productos afectados
knadh · listmonkCVEs relacionadas — knadh listmonk
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-49136CRITICALlistmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege userEPSS 1.6%CVE-2026-62361MEDIUMlistmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentialsEPSS 0.4%CVE-2026-34584MEDIUMlistmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)EPSS 0.3%CVE-2026-21483MEDIUMlistmonk Vulnerable to Stored XSS Leading to Admin Account TakeoverEPSS 0.2%CVE-2025-58430HIGHlistmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account TakeoverEPSS 0.1%