CyberRota Analysis
AI-GeneratedThe vulnerability in listmonk allows authenticated users with specific permissions to exploit the GET /api/subscribers/export endpoint, enabling them to read arbitrary database tables and execute data-modifying queries. This could lead to unauthorized access to sensitive information, such as user data and application settings. Organizations using versions prior to 6.2.0 should prioritize upgrading to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0.