CVE-2025-58430: listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-09-09 · updated 2026-09-30
Weakness: CWE-79

Description

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.

Affected products

knadh listmonk: through 1.1.0

References

Get alerted when CVE-2025-58430 or the next vulnerability affects your stack