CVE-2026-73481 - phpList 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
Brief
CVE ID : CVE-2026-73481
Published : Aug. 13, 2026, 6:48 p. m.
- 16 minutes ago
Description : phpList before 3.
- 0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules. php / bouncerule. php). The deletion is performed via a GET request (? page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present.
A remote attacker can trick an authenticated administrator into loading a crafted URL (e. g. , embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.
Severity: 5.4
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...