MEDIUM 5.5 GitHub
CVE-2026-62361
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
### Summary
A SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — including `users` (bcrypt password hashes) and `settings` (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation
Affected Products
- go/github.com/knadh/listmonk < 1.1.1-0.20260619102436-c0a6525009a6
References
- https://github.com/advisories/GHSA-xgjr-7j9q-2h4r
- https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r
- https://nvd.nist.gov/vuln/detail/CVE-2026-62361
- https://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024
This medium severity vulnerability with a CVSS score of 5.5 was published on 2026-11-06 via GitHub. Affected: go/github.com/knadh/listmonk < 1.1.1-0.20260619102436-c0a6525009a6.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.