CVE-2026-73482 phplist CVE debrief

Who should care

Defenders responsible for phpList installations, particularly those with exposed administrator interfaces, should assess their exposure and prioritize patching or applying workarounds.

Why it matters

Defenders should care about CVE-2026-73482 because it allows an attacker to delete administrator accounts in phpList before 3.7.0-RC5, potentially leading to unauthorized access. Those responsible for phpList installations, especially with exposed administrator interfaces, should verify their exposure and prioritize patching or applying workarounds.

• Potential deletion of administrator accounts
• Increased risk of unauthorized access
• Need for verification of phpList version and exposure
• Priority for applying patches or workarounds

Technical summary

The CSRF vulnerability in phpList before 3.7.0-RC5 allows an attacker to delete administrator accounts via a crafted URL. This is possible because the administrator deletion action is triggered via an unauthenticated GET request that bypasses the CSRF token check. The vulnerability has a CVSS score of 7.2 and is considered HIGH severity. Defenders should prioritize verifying exposure and applying patches or workarounds to prevent potential administrator account deletion and unauthorized access. Those responsible for phpList installations, especially with exposed administrator interfaces, should verify their exposure and prioritize patching or applying workarounds.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent potential administrator account deletion.

Recommended defensive actions

• Verify the version of phpList and upgrade to 3.7.0-RC5 or later
• Implement CSRF protection for administrator deletion actions
• Monitor for suspicious administrator account deletion activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the CSRF vulnerability in phpList before 3.7.0-RC5. The vulnerability allows an attacker to delete administrator accounts via a crafted URL. Evidence is limited to public CVE and NVD sources. Defenders should verify phpList version and exposure, and monitor for suspicious administrator account deletion activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.