CVE-2026-21483 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
Lower-privileged users can inject JavaScript into campaigns, leading to admin account takeover when super admins view the content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21483?
CVE-2026-21483 is a medium-severity cross-site scripting vulnerability in knadh listmonk, published on 2 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or previews this content, the XSS executes in their browser context, allowing the attacker to perform privileged actions such as creating backdoor admin accounts. The attack can be weaponized via the public archive feature, where victims simply need to visit a link - no preview click required. Version 6.0.0 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-21483?
5 open source packages ship an affected version, including github.com/knadh/listmonk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/knadh/listmonk Go | All versions | 1.1.1-0.20251231125615-74dc5a01cfbb |
github.com/knadh/listmonk Go | All versions | 1.1.1-0.20251231125615-74dc5a01cfbb |
github.com/knadh/listmonk Go | All versions | 1.1.1-0.20251231125615-74dc5a01cfbb |
github.com/knadh/listmonk Go | From 1.1.1 | 6.0.0 |
github.com/knadh/listmonk Go | From 1.1.1 | 6.0.0 |
Products include Nadh Listmonk.
How do I fix CVE-2026-21483?
Upgrade github.com/knadh/listmonk to a fixed version for your release line: 1.1.1-0.20251231125615-74dc5a01cfbb or 6.0.0.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-21483 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21483 exists.
Other vulnerabilities in knadh listmonk
- CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user
- CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover
- CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change
- CVE-2025-46011 SQL injection in n/a
- CVE-2026-34584 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)
Sources
Also known as GHSA-jmr4-p576-v565, GO-2026-4277.