← Back to CVE List
CVE-2026-92806NVD
Vulnerability Summary
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
CVSS v4.0 Base Metrics — Score 7.2 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Attack RequirementsNone
Privileges RequiredNone
User InteractionPassive
Confidentiality (Vulnerable System)None
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
CVSS v3.1 Base Metrics — Score 8.1 (HIGH)
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityHigh
Affected & Patched Versions
- phpList phpList < 3.6.17
- phpList phpList 3.6.17
External References
- https://github.com/geo-chen/oss/blob/main/phplist3.md
- https://github.com/phpList/phplist3/blob/v3.6.16/public_html/lists/admin/massremove.php#L13-L24
- https://github.com/phpList/phplist3/blob/v3.6.17/public_html/lists/admin/massremove.php#L10
- https://github.com/phpList/phplist3
- https://www.vulncheck.com/advisories/phplist-before-3.6.17-cross-site-request-forgery-via-massremove-php