CVE-2025-43921 Missing authorization in Mailman

Medium 5.3 Published 20 Apr 2025 Updated 28 Apr 2025

Unauthenticated attackers can create mailing lists via the create endpoint in GNU Mailman, potentially leading to unauthorized data modification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-43921?

CVE-2025-43921 is a medium-severity missing authorization vulnerability in GNU Mailman, published on 20 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Weakness: CWE-863

Which versions are affected by CVE-2025-43921?

It affects 1 product.

Products include Gnu Mailman.

How do I fix CVE-2025-43921?

No fix has been published for CVE-2025-43921 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-43921 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-43921 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-ch5j-3wwr-pjvh.