The vulnerability is a broken access control flaw in the CSV import functionality of listmonk. Users with untrusted privileges in a multi‑user installation can gain access to mailing lists they should not see, leading to potential disclosure of subscriber data and manipulation of lists. This flaw is classified as CWE‑639 and, according to the CVSS score, represents a medium‑risk issue that can compromise confidentiality and integrity of list information.

The defect affects knadh’s listmonk web application, impacting installations from version 4.1.0 up to but excluding version 6.1.0. All deployed environments that enable multi‑user mode and permit untrusted users to import CSV files are exposed. The vulnerability was fixed in the 6.1.0 release.

The CVSS base score of 5.4 indicates moderate severity, while the EPSS score below 1% shows that active exploitation is unlikely at present, and the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with untrusted privileges who can upload CSV data, after which the server’s permission checks are bypassed. Attackers would need to be able to use the web interface to trigger the import; otherwise the vulnerability cannot be abused. Given the low likelihood of exploitation and lack of critical impact, the overall risk is considered moderate but still warranting prompt remediation.