CVE-2026-34828: knadh listmonk insufficient session expiration after password change

CVE-2026-34828 · Severity: high · CVSS 7.1 · Published 2026-04-02

listmonk is a self-hosted newsletter and mailing list manager. A security flaw in its session management allows active login sessions to remain valid even after a user changes or resets their password. This means that if an unauthorized person has gained access to an account, the legitimate owner cannot kick them out simply by updating their password, allowing the attacker to maintain persistent access to subscriber lists and campaign data.

Technologies: github.com/knadh/listmonk (Go). Vendors: Go.

Quick answers

Is CVE-2026-34828 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34828 being exploited in the wild.
How severe is CVE-2026-34828?
High severity, with a CVSS score of 7.1, published 2 April 2026.
Which products and versions are affected?
github.com/knadh/listmonk (Go) SEMVER:introduced=1.1.1-0.20241028090858-319053dd7a90,fixed=1.1.1-0.20260329113754-1b5e8d38c778.
Is there a fix for CVE-2026-34828?
Yes. github.com/knadh/listmonk (Go): upgrade to 1.1.1-0.20260329113754-1b5e8d38c778 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34828 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34828?
Check whether you run github.com/knadh/listmonk (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/knadh/listmonk (Go): upgrade to 1.1.1-0.20260329113754-1b5e8d38c778 or later
    go get github.com/knadh/listmonk@v1.1.1-0.20260329113754-1b5e8d38c778

Technical details

A session management vulnerability (CWE-613) exists in listmonk due to insufficient session revocation. While the application successfully updates account credentials during password reset or manual password changes, it fails to invalidate existing active session tokens stored in the database. An attacker who has previously obtained a valid session cookie (e.g., via session theft or shared access) can maintain persistent access to the account and its API endpoints even after the victim performs a security recovery action. This issue affects both standard accounts and those with TOTP enabled, as the existing session bypasses the login flow. The vulnerability was addressed in version 6.1.0 by implementing a mechanism to wipe user sessions from the database upon credential changes.

Affected products

  • knadh listmonk >= 4.1.0, < 6.1.0

Identifiers

  • CVE-2026-34828
  • GHSA-h5j9-cvrw-v5qh
  • GO-2026-5414

Timeline

  • 2026-03-29: patched: Version 6.1.0 released with fix.
  • 2026-04-01: advisory: GitHub Security Advisory published.
  • 2026-04-02: disclosed: CVE-2026-34828 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.