CVE-2026-21483

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21483", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T14:34:16.005Z", "datePublished": "2026-01-02T20:57:29.332Z", "dateUpdated": "2026-01-02T21:18:57.834Z"}, "containers": {"cna": {"title": "listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565"}], "affected": [{"vendor": "knadh", "product": "listmonk", "versions": [{"version": "< 6.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:57:29.332Z"}, "descriptions": [{"lang": "en", "value": "listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue."}], "source": {"advisory": "GHSA-jmr4-p576-v565", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-02T21:18:17.532399Z", "id": "CVE-2026-21483", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:18:57.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21483", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-02T21:18:17.532399Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-02T21:18:46.885Z"}}], "cna": {"title": "listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover", "source": {"advisory": "GHSA-jmr4-p576-v565", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "knadh", "product": "listmonk", "versions": [{"status": "affected", "version": "< 6.0.0"}]}], "references": [{"url": "https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565", "name": "https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-02T20:57:29.332Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21483", "state": "PUBLISHED", "dateUpdated": "2026-01-02T21:18:57.834Z", "dateReserved": "2025-12-29T14:34:16.005Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-02T20:57:29.332Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "listmonk", "vendor": "knadh", "versions": [{"status": "affected", "version": "< 6.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*", "matchCriteriaId": "41CE03AA-115A-4370-B761-5684D5882B63", "versionEndExcluding": "6.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue."}, {"lang": "es", "value": "listmonk es un gestor de boletines y listas de correo aut\u00f3nomo y autoalojado. Antes de la versi\u00f3n 6.0.0, un usuario con privilegios inferiores y permisos de gesti\u00f3n de campa\u00f1as puede inyectar JavaScript malicioso en campa\u00f1as o plantillas. Cuando un usuario con privilegios superiores (Super Admin) ve o previsualiza este contenido, el XSS se ejecuta en el contexto de su navegador, permitiendo al atacante realizar acciones privilegiadas como crear cuentas de administrador con puerta trasera. El ataque puede ser instrumentalizado a trav\u00e9s de la funci\u00f3n de archivo p\u00fablico, donde las v\u00edctimas simplemente necesitan visitar un enlace - no se requiere hacer clic en la previsualizaci\u00f3n. La versi\u00f3n 6.0.0 corrige el problema."}], "id": "CVE-2026-21483", "lastModified": "2026-06-17T10:18:42.023", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21483", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-02T21:18:17.532399Z", "version": "2.0.3"}}]}, "published": "2026-01-02T21:16:03.217", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T08:28:00.132526+00:00", "value": {"mitigation_remediation": ["Upgrade Listmonk to version 6.0.0 or later", "If upgrade is not possible, disable or restrict the public archive feature to prevent unauthenticated users from viewing potentially malicious content", "Implement a strict content security policy and sanitize all user\u2011supplied campaign and template input to block future XSS injections"], "summary": {"action": "Patch Immediately", "impact": "Admin Privilege Escalation via Stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the open\u2011source newsletter manager Listmonk, distributed by knadh. Versions prior to 6.0.0 are impacted. Lower\u2011privileged users who can manage campaigns or templates can store the malicious code, while higher\u2011privileged users (Super Admins) are the ones that experience the XSS when they view or preview the content. Users running any Listmonk instance that has the public archive feature enabled and is publicly accessible are at risk.", "description_and_impact": "This vulnerability is a stored cross\u2011site scripting flaw that allows a low\u2011privileged user with campaign\u2011management rights to inject malicious JavaScript into newsletter campaigns or email templates. When a higher\u2011privileged Super Admin views or previews the malicious content, the browser executes the script in the admin\u2019s context, enabling the attacker to perform privileged actions such as creating back\u2011door admin accounts or manipulating session data. Because the attack can be triggered via the public archive feature, any visitor who simply opens the advertised link can be exposed, eliminating the need for a targeted preview click.", "risk_and_exploitability": "The CVSS base score is 5.4, indicating medium impact. EPSS is below 1%, suggesting a very low likelihood of exploitation, though the vulnerability remains significant because any visitor who opens a crafted link will trigger the XSS inside an admin browser. The vulnerability is not listed in CISA\u2019s KEV catalog, so there are no known widespread active exploits. Attackers would need access to a public\u2011facing Listmonk deployment with public archive enabled and be able to lure a Super Admin into viewing the malicious campaign. If achieved, the attacker can take over administrative functions. Because the flaw relies on stored XSS rather than remote code execution on the server, the risk is confined to the compromise of the admin client, but it still undermines the integrity and availability of the application."}}}}, "created": "2026-01-05T10:13:46.357272+00:00", "updated": "2026-04-18T08:30:35.833784+00:00", "vendors": ["nadh", "nadh$PRODUCT$listmonk"]}