PT-2026-29816 · Listmonk · Listmonk

0Xmrma · Published 2026-04-01 · Updated 2026-04-02 · CVE-2026-34828

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions listmonk versions 4.1.0 through 6.0.0

Description listmonk, a self-hosted newsletter and mailing list manager, has a session management issue. Previously issued authenticated sessions remain valid after sensitive account security changes, such as password reset or password change. This allows an attacker with a valid session cookie to maintain access to an account even after the victim changes or resets their password, weakening account recovery and session security. The issue occurs because existing sessions are not revoked after account credentials are updated. This impacts all authenticated users, including those with TOTP enabled. The vulnerability was reproduced on version 6.0.0. The application updates account credentials successfully, but existing active sessions are not revoked afterward. The password reset flow and authenticated profile update flow are affected. Relevant code areas include cmd/auth.go, cmd/users.go, and internal/core/users.go.

Recommendations Upgrade to listmonk version 6.1.0 or later.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-34828

GHSA-H5J9-CVRW-V5QH

Affected Products

Listmonk

References · 6

• https://github.com/knadh/listmonk/commit/db82035d619348949512dafdaf60c86037cafc9e · Patch
• https://github.com/knadh/listmonk/security/advisories/GHSA-h5j9-cvrw-v5qh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34828 · Security Note
• https://osv.dev/vulnerability/GHSA-h5j9-cvrw-v5qh · Vendor Advisory
• https://github.com/knadh/listmonk/releases/tag/v6.1.0 · Note
• https://github.com/knadh/listmonk · Note