Description

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T19:17:34.423Z",
  "pubdate": "2026-08-13T19:17:34.423Z",
  "executiveSummary": "A cross-site request forgery (CSRF) vulnerability exists in phpList prior to version 3.7.0-RC5 within the administrative interface. The flaw resides in lists/admin/admins.php, allowing the deletion of administrator accounts through a predictable GET request. The primary security implication is unauthorized account removal, which disrupts system availability and administrative control. This vulnerability impacts phpList deployments running affected versions. An external attacker with remote network access can exploit this flaw by tricking an authenticated super-administrator into accessing a crafted URL. Exploitation requires no prior authentication from the attacker's perspective, relying entirely on social engineering or malicious content injection, such as an embedded image within an email, to force the victim's browser into executing the privileged deletion action against target accounts.",
  "technicalDetails": "The vulnerability stems from insufficient request validation for administrative state-changing actions within the phpList application. Specifically, the administrative deletion action located in lists/admin/admins.php is triggered via an unauthenticated GET request utilizing the parameter pattern ?page=admins&delete=N, where N represents the target administrator identifier. The root cause of the flaw is the improper implementation of cryptographic token validation; the central verifyCsrfGetToken function utilizes an enforce=false parameter configuration, which is bypassed entirely when the token parameter is absent from the incoming HTTP request. Consequently, the application processes the deletion command without verifying whether the request originated from a legitimate user interaction.\nThe attack flow proceeds as follows: a remote attacker crafts a malicious URL pointing to the vulnerable phpList administrative endpoint with the targeted deletion parameters. The attacker then delivers this payload to a targeted, authenticated super-administrator via remote attack vectors, such as embedding the URL as an external resource or image inside an HTML-formatted email or a third-party web page. When the logged-in super-administrator loads the crafted content, their browser automatically issues an asynchronous or standard HTTP GET request to the phpList server, including any valid session cookies associated with the administrative session. Because the session is active and the anti-CSRF token check fails securely due to enforce=false, the phpList backend processes the request and deletes the specified non-self administrator account.\nThe vulnerable component is the administrative management script at lists/admin/admins.php, affecting all phpList versions prior to 3.7.0-RC5. Exploitation requires network exposure of the phpList administrative interface and relies on the victim holding super-administrator privileges while maintaining an active session. Post-exploitation impact includes the unauthorized and permanent removal of administrative accounts from the system, leading to denial of administrative access, disruption of platform operations, and potential cascading security failures within the targeted mailing list infrastructure."
}