- Severity: MEDIUM
- CVE: CVE-2026-62361
- Ecosystems: go
- Packages: github.com/knadh/listmonk
### Summary
A SQL injection vulnerability in `GET /api/subscribers/export` allows an authenticated user with the `subscribers:sql_query` permission to bypass the table access control that exists on the regular query endpoint (`GET /api/subscribers`) and read arbitrary tables from the database — including `users` (bcrypt password hashes) and `settings` (SMTP credentials, API keys). Both error-based and time-based exfiltration techniques are confirmed to work. This creates a privilege escalation path: `subscribers:sql_query` → hash exfiltration → offline bcrypt crack (cost factor 6) → Super Admin account takeover.
—
### Details
The subscriber query feature accepts a user-controlled `query` parameter that is injected directly into a SQL template via `strings.ReplaceAll`. The regular query endpoint `GET /api/subscribers` correctly calls `validateQueryTables` to block access to sensitive tables before execution. The export endpoint `GET /api/subscribers/export` **omits this call entirely**, creating an asymmetric bypass of an intentional security control.
**`internal/core/subscribers.go` — protected path (regular query):**
“`go
// QuerySubscribers — table validation present
stmt := strings.ReplaceAll(c.q.QuerySubscribersTpl, “%query%”, cond)
if err := validateQueryTables(c.db, stmt, allowedSubQueryTables); err != nil {
return nil, 0, echo.NewHTTPError(http.StatusBadRequest,
fmt.Sprintf(“Error preparing subscriber query: %v”, err))
}
“`
**`internal/core/subscribers.go`…
Source: GitHub Security Advisories · 2026-11-06