PT-2026-60307 · Listmonk · Listmonk

CVE-2026-62361 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions listmonk versions prior to 6.2.0

Description The GET '/api/subscribers/export' endpoint fails to call the validateQueryTables function when processing the user-controlled query parameter in QuerySubscribersForExport within internal/core/subscribers.go. This allows an authenticated user with subscribers:sql query and subscribers:get all permissions to read arbitrary database tables, including users and settings, and execute data-modifying PostgreSQL CTEs (Common Table Expressions), which are temporary result sets used within a single SQL statement.

Recommendations Update to version 6.2.0.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-62361

GHSA-XGJR-7J9Q-2H4R

Affected Products

Listmonk

References · 6

• 🔥 https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62361.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-62361 · Security Note
• https://osv.dev/vulnerability/CVE-2026-62361 · Vendor Advisory
• https://github.com/knadh/listmonk/releases/tag/v6.2.0 · Note
• https://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024 · Note