CVE-2026-92806: phpList CSRF Vulnerability in Bulk Actions

CVE-2026-92806 Overview

CVE-2026-92806 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in phpList versions before 3.6.17. The flaw resides in the mass subscriber removal form handler (massremove.php), which fails to validate anti-CSRF tokens before executing state-changing operations. An attacker who lures an authenticated administrator to a crafted page can silently delete and blacklist arbitrary subscriber addresses. The request executes with the administrator's session context, requiring no additional authentication. The vulnerability affects the integrity and availability of subscriber data managed by the phpList newsletter platform.

Critical Impact
Attackers can remove and blacklist arbitrary subscribers from a phpList instance by tricking a logged-in administrator into loading a malicious page.

Affected Products

phpList versions prior to 3.6.17
phpList admin component public_html/lists/admin/massremove.php
Self-hosted phpList newsletter deployments

Discovery Timeline

2026-09-16 - CVE-2026-92806 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92806

Vulnerability Analysis

phpList is an open-source newsletter and mailing list manager written in PHP. The administrative interface exposes a massremove.php endpoint that allows administrators to remove multiple subscribers in a single operation. In versions up to and including 3.6.16, this handler processes submitted subscriber data and performs deletion plus blacklisting without verifying an anti-CSRF token.

Because the browser automatically attaches the administrator's session cookies to any request targeting the phpList domain, a third-party site can issue a forged POST that the application accepts as legitimate. The fix in 3.6.17 introduces a token check at the top of the handler, rejecting requests that lack a valid CSRF token. Refer to the VulnCheck Security Advisory for phpList for the coordinated disclosure details.

Root Cause

The root cause is missing CSRF token validation in the mass subscriber removal handler. As shown in the vulnerable phpList massremove.php code (v3.6.16), the handler acts on submitted parameters using only session cookie authentication. The corresponding patched massremove.php in v3.6.17 adds the token verification call that enforces request origin.

Attack Vector

Exploitation requires an authenticated phpList administrator to visit an attacker-controlled page while their admin session is active. The malicious page auto-submits a hidden HTML form or issues a fetch request that targets the victim's phpList massremove.php endpoint with attacker-chosen subscriber identifiers. The browser attaches the administrator's session cookie, and phpList executes the removal and blacklist operations. No prompt or interaction beyond visiting the page is required after form auto-submission.

The vulnerability can be used to disrupt marketing operations, remove opt-in subscribers, or preemptively blacklist addresses so future re-subscription attempts are silently rejected.

Detection Methods for CVE-2026-92806

Indicators of Compromise

Unexpected entries in phpList audit logs showing bulk subscriber deletion events initiated by admin accounts during normal browsing sessions.
HTTP POST requests to /lists/admin/massremove.php with Referer or Origin headers pointing to external, untrusted domains.
Sudden appearance of legitimate subscriber addresses on the phpList blacklist without a corresponding administrator action.
Web server access logs showing massremove.php POST requests immediately following an administrator visit to an external URL.

Detection Strategies

Correlate phpList admin authentication events with subsequent state-changing POST requests to identify sessions where destructive actions occurred without matching UI navigation.
Deploy web application firewall rules that flag POST requests to massremove.php lacking a valid Referer header matching the phpList origin.
Compare subscriber count deltas across time windows and alert on removals exceeding a configurable threshold within a short interval.

Monitoring Recommendations

Enable and centralize phpList admin action logs, forwarding them to a SIEM for retention and alerting on bulk removal patterns.
Monitor outbound admin browser behavior via egress proxy logs to identify visits to newly registered or low-reputation domains preceding subscriber loss.
Track the phpList blacklist table for unexpected growth and generate daily reports of newly blacklisted email addresses.

How to Mitigate CVE-2026-92806

Immediate Actions Required

Upgrade phpList to version 3.6.17 or later, which enforces CSRF token validation in massremove.php.
Audit the subscribers and blacklist tables for unexpected deletions or additions dating back to the deployment of any affected version.
Instruct phpList administrators to log out of the admin panel when not actively working and avoid opening untrusted links in the same browser session.
Restore removed subscribers from database backups if unauthorized deletions are identified.

Patch Information

The phpList maintainers addressed the issue in version 3.6.17 by adding CSRF token verification at the top of the mass removal handler. The source repository is available at the GitHub phpList Repository, and the specific fix can be reviewed in the patched massremove.php file. Administrators should apply the upgrade rather than backport the single-file change to preserve compatibility with related session and token infrastructure.

Workarounds

Restrict access to the phpList admin path (/lists/admin/) at the web server or reverse proxy layer to a defined allowlist of administrator IP addresses.
Configure the web server to reject POST requests to massremove.php that do not include a Referer header matching the phpList hostname.
Enforce SameSite=Strict on phpList session cookies to prevent cross-site cookie attachment where the deployment environment allows it.
Require administrators to use a dedicated, isolated browser profile for phpList administration to reduce the risk of concurrent malicious page loads.

bash

# Example nginx rule enforcing Referer origin for the vulnerable handler
location = /lists/admin/massremove.php {
    if ($http_referer !~* "^https://phplist\.example\.com/") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}