CVE-2025-58430
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-58430
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-58430.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-58430
- Aliases
- Downstream
- Related
- Published
- 2025-09-09T19:37:45Z
- Modified
- 2025-10-13T04:35:55Z
- Severity
-
- 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
- Details
-
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie
sessionthere includednonce. The value is not checked and validated by the backend, removingnonceallows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available. - References