The /api/subscribers/export endpoint in Listmonk 6.1.x and earlier injects a user‑controlled query parameter directly into an internal database query without validating the table name, enabling an authenticated user who possesses the subscribers:sql_query and subscribers:get_all permissions to read any database table, including users, settings, and sensitive credentials, and to execute data‑modifying Common Table Expressions in PostgreSQL; this pure SQL injection flaw (CWE‑89) allows extraction of admin password hashes and SMTP credentials and the alteration of critical data, but it does not provide remote code execution.

All installations of the Listmonk newsletter manager running any version earlier than 6.2.0, as identified by the vendor knadh for the listmonk product. Any user who has not yet applied the 6.2.0 release is vulnerable.

The CVSS score of 5.5 classifies the flaw as moderate, the EPSS score is below 1 %, and it is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation given current threat observations. However, the attack requires an authenticated session with the two mentioned permissions; once those credentials are in hand, the attacker can exfiltrate sensitive data and modify critical database contents. Although remote code execution is not possible, the exposure of password hashes and SMTP credentials could lead to broader compromise of the host system and any external services linked to the Listmonk instance.