CVE-2026-128334: listmonk 6.2.0 before 7.0.0-beta.2 Missing Authentication via Azure Bounce Webhook
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
listmonkto a version that resolves this vulnerability.Fixed in 7.0.0-beta.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Instances running listmonk 6.2.0 through versions before 7.0.0-beta.2 are exposed if the Azure bounce webhook endpoint is enabled or reachable and no shared secret is configured.
What does an attacker need to exploit this issue?
An attacker only needs the ability to send HTTP POST requests to /webhooks/service/azure. They can forge Azure Event Grid EmailDeliveryReportReceived events with a Bounced status; no authentication is required when a shared secret is absent.
What could a successful attack do?
Forged bounce events can cause arbitrary subscribers to be blocklisted, unsubscribed, or deleted.
What can be done before upgrading?
Configure a shared secret for the Azure bounce webhook to avoid the unauthenticated path. Restricting access to /webhooks/service/azure to trusted Azure Event Grid delivery sources can provide additional protection.