Vulnerability GO-2026-5414
Advisory details are being prepared in the background.
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 25, 2026 at 10:34 PM UTC
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
High Risk
7 months ago
listmonk's active sessions remain valid after password reset and password change
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
Unknown
9 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
Medium Risk
10 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
Unknown
1 year ago
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
* GO-2025-3943
* GO-2025-3943
Impacted packages
Timeline
Published
4 months ago
June 25, 2026 at 10:34 PM UTC
Last Modified
4 months ago
June 25, 2026 at 11:00 PM UTC