CVE-2026-62361: Listmonk SQL Injection Vulnerability

CVE-2026-62361 Overview

CVE-2026-62361 is a SQL injection vulnerability in listmonk, a self-hosted newsletter and mailing list manager. The flaw exists in the GET /api/subscribers/export endpoint, which injects a user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without invoking validateQueryTables. Authenticated users holding subscribers:sql_query and subscribers:get_all permissions can read arbitrary database tables, including users and settings, and execute data-modifying PostgreSQL Common Table Expressions (CTEs). Versions prior to 6.2.0 are affected, and the issue is fixed in 6.2.0.

Critical Impact
An authenticated attacker with SQL query privileges can read sensitive database contents such as administrator credentials in users and application secrets in settings, and modify data through PostgreSQL CTEs.

Affected Products

listmonk versions prior to 6.2.0
Self-hosted listmonk deployments exposing the subscribers export API
PostgreSQL-backed listmonk instances with users assigned subscribers:sql_query and subscribers:get_all roles

Discovery Timeline

2026-07-15 - CVE-2026-62361 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-62361

Vulnerability Analysis

The vulnerability is a SQL Injection flaw classified under [CWE-89]. listmonk exposes two related endpoints that both accept a query parameter used to filter subscribers. The GET /api/subscribers endpoint properly calls validateQueryTables to restrict which tables the caller can reference. The GET /api/subscribers/export endpoint, however, passes the parameter directly into QuerySubscribersForExport without that validation.

Because the injected fragment is concatenated into a PostgreSQL query, an authenticated caller can extend the statement to reference tables outside the intended allow list. The attacker can also chain PostgreSQL CTEs using WITH clauses that perform INSERT, UPDATE, or DELETE operations against arbitrary tables, converting a read-oriented endpoint into a data-modifying primitive.

Root Cause

The root cause is missing input validation on a code path that mirrors another endpoint. The subscribers.go module maintains an allowedSubQueryTables allow list, but the export path never consults it. Authorization enforcement stops at the permission check, so any account granted subscribers:sql_query inherits the ability to reach system tables.

Attack Vector

Exploitation requires network access to the listmonk API and an authenticated session with subscribers:sql_query and subscribers:get_all permissions. The attacker sends a crafted query parameter to /api/subscribers/export that references tables such as users or settings, or that begins with a WITH clause containing data-modifying statements.

// Patch: internal/core/subscribers.go
var (
    allowedSubQueryTables = map[string]struct{}{
        "subscribers":      {},
        "lists":            {},
        "subscriber_lists": {},
        "campaigns":        {},
        "campaign_lists":   {},
        "campaign_views":   {},
        "links":            {},
        "link_clicks":      {},
        "bounces":          {},
    }
)
// Source: https://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024

The patch corrects the subscribers_lists table name and, per the advisory, extends validateQueryTables enforcement to the export path so the allow list is consulted before the query executes.

Detection Methods for CVE-2026-62361

Indicators of Compromise

Requests to /api/subscribers/export containing SQL keywords such as WITH, UNION, SELECT ... FROM users, or FROM settings in the query parameter
PostgreSQL logs showing queries originating from the listmonk role that reference users, settings, or other tables outside the documented allow list
Unexpected modifications to administrator records or application settings shortly after export API calls

Detection Strategies

Enable PostgreSQL log_statement = 'mod' or 'all' and alert on statements from the listmonk service account that touch privileged tables
Instrument the listmonk reverse proxy to log the raw query parameter on /api/subscribers/export requests and match against SQL keyword patterns
Correlate authentication events with export API calls to detect misuse of accounts holding subscribers:sql_query

Monitoring Recommendations

Audit which listmonk user accounts have the subscribers:sql_query and subscribers:get_all permissions and remove them where not required
Monitor outbound data volumes from listmonk export endpoints for anomalous transfer sizes
Track PostgreSQL role activity for CTE-based INSERT, UPDATE, and DELETE operations initiated by the application role

How to Mitigate CVE-2026-62361

Immediate Actions Required

Upgrade listmonk to version 6.2.0 or later, which adds validateQueryTables enforcement to the export endpoint
Rotate credentials stored in the users and settings tables, including SMTP passwords and API tokens, if pre-patch access cannot be ruled out
Review recent access to /api/subscribers/export in application and proxy logs

Patch Information

The fix is included in listmonk v6.2.0. Technical details are in the GitHub Security Advisory GHSA-xgjr-7j9q-2h4r, and the code change is available in the upstream commit.

Workarounds

Revoke the subscribers:sql_query permission from all non-administrative roles until the upgrade is applied
Block or restrict the /api/subscribers/export route at the reverse proxy for sessions that do not originate from trusted management networks
Run listmonk against a PostgreSQL role with the minimum required privileges so CTE-based writes cannot reach unrelated schemas

bash

# Example nginx restriction on the export endpoint
location = /api/subscribers/export {
    allow 10.0.0.0/24;   # management network
    deny all;
    proxy_pass http://listmonk_upstream;
}