SQL Injection in Listmonk Newsletter Manager

CVE-2026-62361

What is CVE-2026-62361?

Listmonk, a self-hosted newsletter and mailing list manager, contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. This issue arises from a failure to properly validate user-controlled query parameters, allowing authenticated users with specific permissions to access arbitrary database tables, such as users and settings. This vulnerability, present in versions prior to 6.2.0, has been fixed in the latest release. Users are advised to upgrade to ensure robust security and safeguard sensitive data.

References