Vulnerability · Published Jan 2, 2026 · Assigned by GitHub_M
CVE-2026-21483listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
Medium 5.4
In plain English
A medium-severity cross-site scripting in listmonk from knadh. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/knadh/listmonk | 6.0.0 | GHSA-jmr4-p576-v565 |
| Go | github.com/knadh/listmonk | 1.1.1-0.20251231125615-74dc5a01cfbb | GHSA-jmr4-p576-v565 |
| Go | github.com/knadh/listmonk | 1.1.1-0.20251231125615-74dc5a01cfbb | GO-2026-4277 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:P
References
- https://github.com/knadh/listmonk/security/advisories/GHSA-jmr4-p576-v565 x_refsource_CONFIRM