CVE-2026-73482

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.7.0-RC5

Description A cross-site request forgery (CSRF) issue exists in the 'lists/admin/admins.php' endpoint. The administrator deletion action is triggered via a GET request using the delete parameter that lacks CSRF token protection. This occurs because the verifyCsrfGetToken() function uses enforce=false, allowing the check to be bypassed if the token parameter is missing. A remote attacker can trick a logged-in super-administrator into loading a crafted URL to delete any administrator account other than their own.

Recommendations Update to version 3.7.0-RC5 or later.