{"id":"CVE-2026-73481","title":"phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php)","summary":"phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (ve…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cwe":["CWE-352"],"published":"2026-08-13","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:06:30.133","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73481","references":[{"url":"https://github.com/phpList/phplist3/commit/5159c3ed33a5674a8169472b50d146d97f630746","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpList/phplist3/issues/1116","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpList/phplist3/pull/1121","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpList/phplist3/releases/tag/v3.7.0-RC5","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/phplist-rc5-cross-site-request-forgery-via-bounce-rules","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"epss":0.00222,"epssPercentile":0.11335,"ingestedAt":"2026-09-24T20:51:40.200Z","slug":"CVE-2026-73481","body":"## Overview\n\nphpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with enforce=false, so it only validates the token when a 'tk' parameter is present. A remote attacker can trick an authenticated administrator into loading a crafted URL (e.g., embedded in an image tag) to delete arbitrary bounce rules from the phplist_bounceregex table without a valid CSRF token.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}