PT-2026-1133 · Listmonk · Listmonk

Playeriunknown · Published 2026-01-02 · Updated 2026-01-17 · CVE-2026-21483

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions listmonk versions prior to 6.0.0

Description listmonk is a self-hosted newsletter and mailing list manager. A user with campaign management permissions, but lower privileges, can inject malicious JavaScript into campaigns or templates. When a user with higher privileges (Super Admin) views or previews this content, the JavaScript executes in their browser, potentially allowing the attacker to perform privileged actions, such as creating backdoor admin accounts. The issue can be exploited through the public archive feature, requiring only a link visit from the victim, without needing to preview the content. The vulnerable component is the campaign or template functionality.

Recommendations Update to version 6.0.0 or later.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-21483

GHSA-JMR4-P576-V565

GO-2026-4277

SUSE-SU-2026:0142-1

Affected Products

Listmonk

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21483.json · Exploit
• https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jmr4-p576-v565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21483 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21483 · Vendor Advisory
• https://github.com/knadh/listmonk · Note
• https://github.com/knadh/listmonk/releases/tag/v6.0.0 · Note
• https://github.com/knadh/listmonk/commit/74dc5a01cfbb12cf218cb33ddad8410c53e2e915 · Note
• https://suse.com/security/cve/CVE-2025-62877 · Note
• https://suse.com/security/cve/CVE-2025-68954 · Note
• https://suse.com/security/cve/CVE-2017-18895 · Note
• https://suse.com/security/cve/CVE-2025-14986 · Note
• https://twitter.com/CVEnew/status/2007202761499390193 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2007298427361632635 · Twitter Post