CVE-2026-73481 in phpList
Summary
by MITRE • 08/13/2026
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical cross-site request forgery weakness in phpList versions prior to 3.7.0-RC5 that directly impacts the application's security posture and data integrity. The flaw exists within the bounce rule deletion functionality where the system fails to properly enforce csrf token validation during the deletion process. The vulnerability is particularly concerning because it allows remote attackers to manipulate the application through authenticated administrator sessions without requiring any additional authentication credentials.
The technical implementation of this flaw stems from the improper handling of csrf protection mechanisms within the bouncerules.php and bouncerule.php endpoints. When administrators attempt to delete bounce rules via the GET request interface using parameters such as ?page=bouncerules&del=N, the system invokes the verifyCsrfGetToken function but passes enforce=false as a parameter. This configuration means that csrf validation only occurs when a 'tk' parameter is explicitly present in the request, creating a significant gap in security controls. The absence of mandatory csrf token enforcement for this critical operation allows attackers to construct malicious requests that bypass the intended security measures.
The operational impact of this vulnerability extends beyond simple data manipulation, as it provides attackers with the ability to disrupt email delivery systems managed by phpList. By deleting bounce rules from the phplist_bounceregex table, adversaries can potentially compromise the system's ability to properly handle bounced emails, leading to spam accumulation, delivery failures, and potential exposure of sensitive email lists. This type of attack falls under the category of persistent security weaknesses that can be exploited repeatedly without detection, making it particularly dangerous for organizations relying on phpList for their email marketing operations.
The vulnerability aligns with CWE-352, which specifically addresses cross-site request forgery issues in software applications. From an attack perspective, this weakness maps directly to several ATT&CK techniques including T1078 for valid accounts and T1566 for credential access through social engineering. The ability to exploit this flaw without requiring authentication credentials makes it particularly attractive to attackers who may already have access to legitimate administrator sessions through other means such as phishing or session hijacking attacks. Organizations using vulnerable versions of phpList should immediately implement mitigations including proper csrf token enforcement, input validation, and monitoring for unauthorized deletion operations.
The recommended remediation strategy involves updating to phpList version 3.7.0-RC5 or later where proper csrf token enforcement has been implemented for all critical endpoints. Additionally, administrators should ensure that all GET requests involving destructive operations require mandatory csrf tokens and that the application properly validates these tokens regardless of parameter presence. Security monitoring should be enhanced to detect unusual deletion patterns and unauthorized access attempts to bounce rule management features. The implementation of rate limiting and additional audit logging around administrative functions will help detect potential exploitation attempts and provide forensic evidence for incident response activities.