Session Management Vulnerability in Listmonk by Knadh

CVE-2026-34828

What is CVE-2026-34828?

Listmonk, a self-hosted newsletter and mailing list manager, suffers from a session management vulnerability that permits an attacker to maintain access to an account even after sensitive security actions like password resets or changes. Specifically, valid session cookies issued prior to changes remain valid, undermining the integrity of session security and account recovery protocols. This vulnerability has been addressed in version 6.1.0, which users are encouraged to upgrade to for enhanced protection against unauthorized access.

References