CVE-2026-73482 - phpList 3.7.0-RC5 Cross-Site Request Forgery via admins.php
Brief
CVE ID : CVE-2026-73482
Published : Aug. 13, 2026, 6:49 p. m.
- 16 minutes ago
Description : phpList before 3.
- 0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins. php. The administrator deletion action is triggered via an unauthenticated GET request (? page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent).
A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e. g. , embedded as an image in an email) to delete any non-self administrator account.
Severity: 8.1
- HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...