CVE-2026-62361

MediumCVSS 5.5/10Last modified Oct 24, 2026

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
knadh	listmonk	< 6.2.0

References

Timeline

Published: Jul 15, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-623624.9PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.CVE-2026-623635.0ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer CVE-2026-623642.3wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblat CVE-2026-623655.3Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/a CVE-2026-623677.5Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provi CVE-2026-623688.4Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in Custom CVE-2026-623698.1KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 un CVE-2026-62376.4The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all v CVE-2026-623706.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 unt CVE-2026-623718.8KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 un CVE-2026-623747.1SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/dec CVE-2026-623768.1Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and accoun