CVE-2025-58430
The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the backend, removing `nonce` allows the requests to be processed correctly. This may seem harmless, but if chained to other vulnerabilities it can become a critical vulnerability. Cross-site request forgery and cross-site scripting chained together can result in improper admin account creation. As of time of publication, no patched versions are available.
- CVSS 4.0
- 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.14% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-80, CWE-352
- Affected
- nadh/listmonk
- Source
- security-advisories@github.com
References
- https://github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7wExploit, Third Party Advisory
- https://github.com/knadh/listmonk/security/advisories/GHSA-rf24-wg77-gq7wExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.