Vulnerability in Knadh Listmonk
CVE-2026-34828
listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.
EPSS: 0.003 (22.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Knadh Listmonk — versions >= 4.1.0, < 6.1.0
- Nadh Listmonk
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Product, x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2026-34828?
- CVE-2026-34828 is a high-severity vulnerability in Knadh Listmonk, classified under Insufficient Session Expiration. CVSS score: 7.1/10. Published 2026-04-02.
- How severe is CVE-2026-34828?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2026-34828 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.