HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-73482 — phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerabil...

·Source: NIST NVD

Updated:

Executive Summary

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logge

Analysis

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account. CVSS Score: 8.1. Published: 2026-08-13T19:17:34.423.

Indicators of Compromise (1)

CVE (1)
CVE-2026-73482
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Aug 13, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

New AI Playbooks Will Target Healthcare Cyber Risk

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/new-ai-playbooks-will-target-healthcare-cyber-risk-image_small-4-a-32572.jpg" align=right hspace=4><b>Dr. Brian Anderson, CEO of the Coalition for Heath AI, on Frontier AI Threats</b><br>Frontier AI models can identify network vulnerabilities and compress attacks from days or weeks into seconds, raising the stakes for healthcare.

Bank Info Security
MEDIUMVulnerability

Friday Squid Blogging: Searching for the Colossal Squid

Fascinating video about searching for life undersea. The video basically makes the point that our bright white searchlights are scaring everything away, and that red light is more neutral. That, plus bait to attract sea creatures, is teaching us a lot about what&#8217;s going on down there. Lots of footage of giant squid, and speculation about the colossal squid. Worth watching. As usual, you can

Schneier on Security
MEDIUMVulnerability

Investigation of banking hack leads to arrests in Germany, Brazil

Germany’s federal police agency, the BKA, said three suspects were picked up in Europe and charged with fraud, and Brazil’s federal police said four others were arrested on similar charges.

The Record