listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook
Summary
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/servi...
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| knadhlistmonk |
≥ 6.2.0, < 7.0.0-beta.2→ 7.0.0-beta.2 |
7.0.0-beta.2 |
Original description The description as published by the source.
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.
Source: CVE.org (CVE Program・cvelistV5) NVD