Vulnerability GHSA-h5j9-cvrw-v5qh
Advisory details are being prepared in the background.
High Risk
HIGH RISK
CVSS Score: 7.1
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
7 months ago
April 01, 2026 at 11:48 PM UTC
listmonk's active sessions remain valid after password reset and password change
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
v0.1.0-alpha - v1.1.0 GHSA-xgjr-7j9q-2h4r
v0.1.0-alpha - v1.1.0 GHSA-xgjr-7j9q-2h4r
Unknown
4 months ago
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
Unknown
9 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
v0.1.0-alpha - v1.1.0 GO-2026-4277
v0.1.0-alpha - v1.1.0 GO-2026-4277
Medium Risk
10 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
v0.1.0-alpha - v1.1.0 GHSA-jmr4-p576-v565
v0.1.0-alpha - v1.1.0 GHSA-jmr4-p576-v565
Unknown
1 year ago
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
v0.1.0-alpha - v1.1.0 GO-2025-3943
v0.1.0-alpha - v1.1.0 GO-2025-3943
Impacted packages
Timeline
Published
7 months ago
April 01, 2026 at 11:48 PM UTC
Last Modified
4 months ago
June 25, 2026 at 11:11 PM UTC