CVE-2026-128334 · Package
NO FIX YET · SEE WHAT TO DO
listmonk accepts Azure Event Grid bounce webhooks without authentication when no shared secret is configured. An unauthenticated attacker can forge bounce events to blocklist, unsubscribe or delete any subscriber.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running listmonk 6.2.0 before 7.0.0-beta.2 that receive Azure Event Grid bounce webhooks and have no shared secret configured for them. Instances that do not use the Azure bounce webhook, or that have a shared secret set, are not exposed by this flaw as described.
Not affected if default-config-not-used, no-azure-webhook, shared-secret-set
Who cares azure, email, listmonk, self-hosted
listmonk --version or the admin UI; affected versions are 6.2.0 up to but not including 7.0.0-beta.2./webhooks/service/azure being reachable from the internet.7.0.0-beta.2 or later.listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.