CVE-2026-62361 Details

A SQL injection vulnerability has been identified in Listmonk versions prior to 6.2.0, specifically in the GET /api/subscribers/export endpoint. This vulnerability allows authenticated users with the subscribers:sql_query and subscribers:get_all permissions to bypass table access controls and read arbitrary database tables, such as users and settings. The issue arises because the export endpoint does not validate user-controlled query parameters before executing them, unlike the regular subscriber query endpoint. As a result, sensitive information, including bcrypt password hashes and SMTP credentials, can be extracted from the database. Additionally, the vulnerability allows the execution of data-modifying PostgreSQL Common Table Expressions (CTEs), further escalating the impact.

Users are advised to upgrade to Listmonk version 6.2.0, which addresses this vulnerability by implementing the necessary SQL query validation on the subscriber export endpoint.