Search

CVE-2026-73481 - phpList 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

CVE ID : CVE-2026-73481 Published : Aug. 13, 2026, 6:48 p. m. • 16 minutes ago Description : phpList before 3. 7. 0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules. php / bouncerule. php). The deletion is performed via a GET request (? page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e. g. , embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token. Severity: 5.4 • MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...