Vulnerability Details CVE-2025-58430
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 6.5%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2025-58430
-
cpe:2.3:a:nadh:listmonk:0.1.0
-
cpe:2.3:a:nadh:listmonk:0.1.1
-
cpe:2.3:a:nadh:listmonk:0.1.2
-
cpe:2.3:a:nadh:listmonk:0.2.0
-
cpe:2.3:a:nadh:listmonk:0.2.1
-
cpe:2.3:a:nadh:listmonk:0.2.2
-
cpe:2.3:a:nadh:listmonk:0.3.0
-
cpe:2.3:a:nadh:listmonk:0.3.1
-
cpe:2.3:a:nadh:listmonk:0.3.2
-
cpe:2.3:a:nadh:listmonk:0.3.3
-
cpe:2.3:a:nadh:listmonk:0.4.0
-
cpe:2.3:a:nadh:listmonk:0.5.0
-
cpe:2.3:a:nadh:listmonk:0.5.1
-
cpe:2.3:a:nadh:listmonk:0.5.2
-
cpe:2.3:a:nadh:listmonk:0.6.0
-
cpe:2.3:a:nadh:listmonk:0.6.1
-
cpe:2.3:a:nadh:listmonk:0.6.2
-
cpe:2.3:a:nadh:listmonk:0.7.0
-
cpe:2.3:a:nadh:listmonk:0.8.0
-
cpe:2.3:a:nadh:listmonk:0.9.0
-
cpe:2.3:a:nadh:listmonk:1.0.0
-
cpe:2.3:a:nadh:listmonk:1.1.0