Executive brief
listmonk is a self-hosted newsletter and mailing list manager. A security flaw in its session management allows active login sessions to remain valid even after a user changes or resets their password. This means that if an unauthorized person has gained access to an account, the legitimate owner cannot kick them out simply by updating their password, allowing the attacker to maintain persistent access to subscriber lists and campaign data.
Technical details
A session management vulnerability (CWE-613) exists in listmonk due to insufficient session revocation. While the application successfully updates account credentials during password reset or manual password changes, it fails to invalidate existing active session tokens stored in the database. An attacker who has previously obtained a valid session cookie (e.g., via session theft or shared access) can maintain persistent access to the account and its API endpoints even after the victim performs a security recovery action. This issue affects both standard accounts and those with TOTP enabled, as the existing session bypasses the login flow. The vulnerability was addressed in version 6.1.0 by implementing a mechanism to wipe user sessions from the database upon credential changes.
Affected products
- knadh listmonk >= 4.1.0, < 6.1.0
Timeline
- 2026-03-29: patched: Version 6.1.0 released with fix.
- 2026-04-01: advisory: GitHub Security Advisory published.
- 2026-04-02: disclosed: CVE-2026-34828 published to NVD.