CVE-2026-73481

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5

Description Cross-Site Request Forgery (CSRF) occurs because the application fails to enforce token validation on the bounce rule deletion endpoints 'bouncerules.php' and 'bouncerule.php'. The deletion process is executed via a GET request using the page and del parameters. The verifyCsrfGetToken() function is called with the enforce variable set to false, meaning the token is only validated if the tk parameter is explicitly provided. A remote attacker can trick an authenticated administrator into loading a crafted URL to delete arbitrary bounce rules from the phplist bounceregex table.

Recommendations Update phpList to version 3.7.0-RC5 or later.