Executive brief
listmonk, a self-hosted newsletter and mailing list manager, contains a security flaw in its subscriber export feature. An authorized user with specific query permissions can bypass security restrictions to access sensitive database information, such as administrator password hashes and SMTP credentials. This could lead to a full takeover of the mailing list system and exposure of private configuration data.
Technical details
A SQL injection vulnerability exists in the GET /api/subscribers/export endpoint of listmonk. While the standard query endpoint implements a 'validateQueryTables' check to restrict access to sensitive tables, the export endpoint omits this validation, directly injecting user-controlled query parameters into a SQL template. An authenticated attacker with 'subscribers:sql_query' and 'subscribers:get_all' permissions can exploit this to read arbitrary tables (such as 'users' for bcrypt hashes and 'settings' for SMTP credentials) using error-based or time-based exfiltration. Additionally, because the export path does not use a read-only transaction, attackers can execute data-modifying PostgreSQL Common Table Expressions (CTEs). The issue is resolved in version 6.2.0.
Affected products
- knadh listmonk < 6.2.0
Timeline
- 2026-06-26: patched: Version 6.2.0 released
- 2026-06-26: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD