CVE-2026-34584 MEDIUM

CVE-2026-34584: listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)

Vendor Knadh

Product listmonk

Weakness CWE-639 · IDOR

Published April 2, 2026

Last update April 2, 2026

View on NVD All CVEs

CVSS base score

5.4/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under different scenarios. This only affects multi-user environments with untrusted users. This issue has been patched in version 6.1.0.

Key dates

02Disclosure timeline

April 2, 2026 CVE published

April 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-34584 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html

Related vulnerabilities

04Related CVE

CVE-2022-0624 Authorization Bypass Through User-Controlled Key in ionicabizau/parse-path CVE-2026-9087 Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login CVE-2026-32589 Mirror-registry: quay: insecure direct object reference in blobupload CVE-2025-10570 Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund CVE-2026-34046 Langflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check