CVE-2026-92806: phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpListto a version that resolves this vulnerability.Fixed in 3.6.17 - Compensating control
Because phpList versions before 3.6.17 have CSRF token validation failures in massremove.php, restrict access to phpList administrative endpoints (where mass subscriber removal is performed) to trusted users/IPs using network controls (e.g., firewall/ACL).
Event History
Frequently Asked Questions
Who can be targeted by this issue?
Organizations using phpList versions before 3.6.17 are exposed when a phpList administrator is logged in and can be induced to visit an attacker-controlled crafted page.
What does an attacker need to exploit it?
The attacker does not need phpList authentication, but exploitation requires user interaction from a logged-in administrator visiting the crafted page. The attack is network-reachable and has low complexity.
What is the impact of a successful attack?
A successful request can silently delete and blacklist arbitrary subscriber addresses. The reported impact affects integrity and availability, with no confidentiality impact indicated.
How can this be remediated?
Upgrade phpList to version 3.6.17 or later, which adds CSRF-token validation to the mass subscriber removal handler.