CVE-2021-40347

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-10 · updated 2026-06-17

Description

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.

Affected products

Postorius project Postorius: before 1.3.5 — fixed in 1.3.5

How to fix

Upgrade to a fixed version: Postorius project Postorius 1.3.5. Check the vendor advisory for mitigations.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746
https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b
https://gitlab.com/mailman/postorius/-/issues/531
https://gitlab.com/mailman/postorius/-/tags
https://phabricator.wikimedia.org/T289798
https://www.debian.org/security/2021/dsa-4970
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746
https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b
https://gitlab.com/mailman/postorius/-/issues/531
https://gitlab.com/mailman/postorius/-/tags
https://phabricator.wikimedia.org/T289798
https://www.debian.org/security/2021/dsa-4970

Get alerted when CVE-2021-40347 or the next vulnerability affects your stack