7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34828

CVE-2026-34828: listmonk: Active sessions remain valid after password reset and password change

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically password reset and password change. As a result, an attacker who has already obtained a valid session cookie can retain access to the account even after the victim changes or resets their password. This weakens account recovery and session security guarantees. This issue has been patched in version 6.1.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34828

CVE-2026-34828:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/knadh/listmonk	go	>= 1.1.1-0.20241028090858-319053dd7a90, < 1.1.1-0.20260329113754-1b5e8d38c778	1.1.1-0.20260329113754-1b5e8d38c778

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the application's failure to invalidate existing user sessions after a password change or reset. This allows an attacker with a stolen session cookie to maintain access to a user's account even after the user has changed their credentials.

To identify the vulnerable functions, I first compared the git tags of the vulnerable version v6.0.0 and the patched version v6.1.0. This revealed a key commit with the message "Wipe user sessions from DB on password reset/change." (db82035d619348949512dafdaf60c86037cafc9e).

Analyzing this commit showed the introduction of a new function, core.DeleteUserSessions, which is responsible for deleting a user's sessions from the database. The patch then adds calls to this new function in three specific locations that correspond to the scenarios described in the vulnerability report:

App.doResetPassword in cmd/auth.go: This function handles the forgot-password flow. The patch adds a call to DeleteUserSessions to invalidate all of the user's sessions upon a successful password reset.
App.UpdateUser in cmd/users.go: This function is used by administrators to update user details. The patch ensures that if an admin changes a user's password, all of that user's sessions are terminated.
App.UpdateUserProfile in cmd/users.go: This function is used by a user to update their own profile. The patch adds a call to DeleteUserSessions to terminate all other active sessions, keeping only the current one alive.

These three functions were the points of vulnerability because they modified user credentials without performing the necessary session invalidation, thus creating a window for unauthorized account persistence.

Vulnerable functions

App.doResetPassword

cmd/auth.go

This function handles the password reset flow. Before the patch, it would reset the user's password and create a new session, but it failed to invalidate any other existing sessions for that user. This allowed an attacker with a stolen session to maintain access even after the legitimate user reset their password.

App.UpdateUser

cmd/users.go

This function allows an administrator to update a user's profile, including their password. The vulnerability existed because when an admin changed a user's password, the user's existing active sessions were not terminated. The patch adds a call to delete all sessions for the user if their password was changed.

App.UpdateUserProfile

cmd/users.go

This function allows a logged-in user to update their own profile, including changing their password. The vulnerability was that changing the password did not invalidate other active sessions for the same user (e.g., on another device or browser). An attacker who had stolen a session could therefore remain logged in. The fix is to delete all other sessions for the user, except for the current one being used to change the password.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.