CVE-2026-128334
Deferred Deferred - Pending Action

Missing Authentication in listmonk Webhook Handling

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128334
EUVD
EUVD-2026-125043

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
listmonk listmonk to 7.0.0-beta.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-636 When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-128334 is a missing authentication vulnerability in listmonk versions 6.2.0 through 7.0.0-beta.2. It allows unauthenticated attackers to submit forged Azure Event Grid bounce webhooks by posting malicious EmailDeliveryReportReceived events with a Bounced status to /webhooks/service/azure. This can blocklist, unsubscribe, or delete arbitrary subscribers without authentication.

Detection Guidance

Check for unauthorized POST requests to /webhooks/service/azure with Bounced status events. Monitor for unexpected subscriber blocklist, unsubscribe, or deletion actions without authentication. Review logs for Azure Event Grid bounce webhook submissions from untrusted sources.

Impact Analysis

Attackers can exploit this to manipulate subscriber lists by blockinglist, unsubscribing, or deleting users without authorization. This disrupts email marketing campaigns and may lead to loss of subscriber trust or data integrity issues.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized modification or deletion of subscriber data without consent. For HIPAA, it may risk exposure of personal health information if subscriber lists are altered improperly. Compliance requires ensuring subscriber data integrity and consent.

Mitigation Strategies

Upgrade to listmonk v7.0.0-beta.2 or later to enforce shared secret authentication for Azure bounce webhooks. Ensure shared secrets are configured and not left empty. Restrict access to /webhooks/service/azure endpoints and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...