---
id: "CVE-2026-128334"
page: "https://infrastack.ai/live/CVE-2026-128334"
kind: "vulnerability"
aliases: ["CVE-2026-128334"]
title: "listmonk: unauthenticated Azure bounce webhook lets attackers delete subscribers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["azure", "email", "listmonk", "package", "self-hosted"]
not_affected_if: ["default-config-not-used", "no-azure-webhook", "shared-secret-set"]
published_at: "2026-11-13T10:18:13+00:00"
first_seen_at: "2026-11-13T10:47:34+00:00"
updated_at: "2026-11-13T10:55:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128334", "first_seen_at": "2026-11-13T10:47:34+00:00"}]
exploit_sources: []
---

# listmonk: unauthenticated Azure bounce webhook lets attackers delete subscribers

Link for people: https://infrastack.ai/live/CVE-2026-128334 (this .md is for agents)

listmonk accepts Azure Event Grid bounce webhooks without authentication when no shared secret is configured. An unauthenticated attacker can forge bounce events to blocklist, unsubscribe or delete any subscriber.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the listmonk version with `listmonk --version` or the admin UI; affected versions are `6.2.0` up to but not including `7.0.0-beta.2`.
- Look for the Azure bounce webhook endpoint `/webhooks/service/azure` being reachable from the internet.
- Check whether a shared secret is set for the Azure webhook in the listmonk settings; unknown whether the sources name the exact setting.

## Fix

- Upgrade listmonk to `7.0.0-beta.2` or later.

## Timeline

- 2026-11-13T10:47:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128334

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/listmonk-6.2.0-before-7.0.0-beta.2-missing-authentication-via-azure-bounce-webhook
- [fix] Patch: github.com https://github.com/knadh/listmonk/commit/0c155bd2663d9ec8053ac0d1ab63f021fbb5a0dc
- [fix] Release notes: github.com https://github.com/knadh/listmonk/releases/tag/v7.0.0-beta.2

## From the sources

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_