{"id":"CVE-2026-128334","kind":"vulnerability","aliases":["CVE-2026-128334"],"related":[],"title":"listmonk: unauthenticated Azure bounce webhook lets attackers delete subscribers","description":"listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.","summary":"listmonk accepts Azure Event Grid bounce webhooks without authentication when no shared secret is configured. An unauthenticated attacker can forge bounce events to blocklist, unsubscribe or delete any subscriber.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","email","listmonk","package","self-hosted"],"not_affected_if":["default-config-not-used","no-azure-webhook","shared-secret-set"],"how_to_check":"- Check the listmonk version with `listmonk --version` or the admin UI; affected versions are `6.2.0` up to but not including `7.0.0-beta.2`.\n- Look for the Azure bounce webhook endpoint `/webhooks/service/azure` being reachable from the internet.\n- Check whether a shared secret is set for the Azure webhook in the listmonk settings; unknown whether the sources name the exact setting.","fix":"- Upgrade listmonk to `7.0.0-beta.2` or later.","status":"open","published_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:55:11+00:00","updated_at":"2026-11-13T10:55:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:55:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade listmonk to `7.0.0-beta.2` or later.","reach":"internet","title":"listmonk: unauthenticated Azure bounce webhook lets attackers delete subscribers","impact":"medium","summary":"listmonk accepts Azure Event Grid bounce webhooks without authentication when no shared secret is configured. An unauthenticated attacker can forge bounce events to blocklist, unsubscribe or delete any subscriber.","audience":"businesses","category":"package","nicknames":[],"who_cares":["listmonk","self-hosted","azure","email"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker blocklists, unsubscribes or deletes arbitrary subscribers","analyst_note":"","how_to_check":"- Check the listmonk version with `listmonk --version` or the admin UI; affected versions are `6.2.0` up to but not including `7.0.0-beta.2`.\n- Look for the Azure bounce webhook endpoint `/webhooks/service/azure` being reachable from the internet.\n- Check whether a shared secret is set for the Azure webhook in the listmonk settings; unknown whether the sources name the exact setting.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config-not-used","no-azure-webhook","shared-secret-set"],"who_is_affected":"Teams running listmonk 6.2.0 before 7.0.0-beta.2 that receive Azure Event Grid bounce webhooks and have no shared secret configured for them. Instances that do not use the Azure bounce webhook, or that have a shared secret set, are not exposed by this flaw as described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4654,"output_tokens":622,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128334':12A,15A '-2026':11A,14A '/webhooks/service/azure':89C '6.2.0':53C '7.0.0':55C 'accept':24B 'allow':63C 'arbitrari':95C 'attack':7A,40B,65C,79C 'authent':31B,60C 'azur':3A,16B,25B,68C 'beta.2':56C 'blocklist':46B,91C 'bounc':4A,28B,43B,71C,86C 'configur':37B,78C 'contain':57C 'cve':10A,13A 'delet':8A,49B,94C 'email':17B 'emaildeliveryreportreceiv':83C 'event':26B,44B,69C,84C 'forg':42B,82C 'grid':27B,70C 'host':22B 'let':6A 'listmonk':1A,18B,23B,52C 'miss':59C 'packag':19B 'post':81C 'secret':35B,76C 'self':21B 'self-host':20B 'share':34B,75C 'status':87C 'submit':67C 'subscrib':9A,51B,96C 'unauthent':2A,39B,64C 'unsubscrib':47B,92C 'vulner':61C 'webhook':5A,29B,72C 'without':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running listmonk 6.2.0 before 7.0.0-beta.2 that receive Azure Event Grid bounce webhooks and have no shared secret configured for them. Instances that do not use the Azure bounce webhook, or that have a shared secret set, are not exposed by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","email","listmonk","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-128334':12A,15A '-2026':11A,14A 'attack':7A 'azur':3A 'bounc':4A 'cve':10A,13A 'delet':8A 'let':6A 'listmonk':1A 'subscrib':9A 'unauthent':2A 'webhook':5A","search_b":"'accept':24B 'attack':40B 'authent':31B 'azur':16B,25B 'blocklist':46B 'bounc':28B,43B 'configur':37B 'delet':49B 'email':17B 'event':26B,44B 'forg':42B 'grid':27B 'host':22B 'listmonk':18B,23B 'packag':19B 'secret':35B 'self':21B 'self-host':20B 'share':34B 'subscrib':51B 'unauthent':39B 'unsubscrib':47B 'webhook':29B 'without':30B","search_c":"'/webhooks/service/azure':89C '6.2.0':53C '7.0.0':55C 'allow':63C 'arbitrari':95C 'attack':65C,79C 'authent':60C 'azur':68C 'beta.2':56C 'blocklist':91C 'bounc':71C,86C 'configur':78C 'contain':57C 'delet':94C 'emaildeliveryreportreceiv':83C 'event':69C,84C 'forg':82C 'grid':70C 'listmonk':52C 'miss':59C 'post':81C 'secret':76C 'share':75C 'status':87C 'submit':67C 'subscrib':96C 'unauthent':64C 'unsubscrib':92C 'vulner':61C 'webhook':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128334","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128334","severity":null,"published_at":"2026-11-13T10:18:13+00:00","modified_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null}],"documents":[{"id":145462,"url":"https://github.com/knadh/listmonk/commit/0c155bd2663d9ec8053ac0d1ab63f021fbb5a0dc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145457,"url":"https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145464,"url":"https://www.vulncheck.com/advisories/listmonk-6.2.0-before-7.0.0-beta.2-missing-authentication-via-azure-bounce-webhook","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}