CVE-2026-34828
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
How to fix
- nadh listmonk6.1.0 or later
- github.com/knadh/listmonk1.1.1-0.20260329113754-1b5e8d38c778 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nadh listmonk | 4.1.0 ≤ v < 6.1.0 | 6.1.0 |
| github.com/knadh/listmonkGo | 1.1.1-0.20241028090858-319053dd7a90 ≤ v < 1.1.1-0.20260329113754-1b5e8d38c778 | 1.1.1-0.20260329113754-1b5e8d38c778 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.