CVE-2026-92806 phpList CVE debrief

Who should care

Administrators and security teams responsible for phpList installations should assess exposure and prioritize verification and remediation efforts. They should review and adjust authentication and authorization settings for the mass subscriber removal form handler to prevent unauthorized actions. Additionally, they should monitor for suspicious mass subscriber removal activity and perform regular security audits to identify vulnerabilities.

Why it matters

The CVE-2026-92806 vulnerability in phpList allows attackers to induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification. This vulnerability requires verification and remediation efforts from administrators and security teams.

• Verification of phpList installations and updates to version 3.6.17 or later is required to prevent exploitation.
• Monitoring for suspicious mass subscriber removal activity is necessary to detect potential attacks.
• Administrators and security teams must review and adjust authentication and authorization settings for the mass subscriber removal form handler to prevent unauthorized actions.

Technical summary

The vulnerability exists in the mass subscriber removal form handler of phpList versions before 3.6.17. An attacker can induce a logged-in administrator to visit a crafted page, resulting in the silent deletion and blacklisting of arbitrary subscriber addresses without authentication verification. The vulnerability is caused by a lack of proper validation of cross-site request forgery tokens, allowing attackers to perform unauthorized actions. phpList versions before 3.6.17 are affected, and administrators should prioritize verifying and updating their installations to prevent exploitation.

Defensive priority

Administrators and security teams should prioritize verifying and updating phpList installations to version 3.6.17 or later, and monitor for suspicious mass subscriber removal activity.

Recommended defensive actions

• Verify phpList installations and update to version 3.6.17 or later
• Monitor for suspicious mass subscriber removal activity
• Review and adjust authentication and authorization settings for the mass subscriber removal form handler
• Perform a thorough review of system logs to detect potential attacks
• Implement additional security measures such as IP blocking or rate limiting
• Conduct regular security audits to identify vulnerabilities
• Develop an incident response plan in case of a successful attack

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. Further verification is required to determine the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.