{"id":"CVE-2021-40347","aliases":["DEBIAN-CVE-2021-40347","DSA-4970-1","EUVD-2021-0197","GHSA-v83x-78q3-gr2j","PYSEC-2021-319","UBUNTU-CVE-2021-40347","USN-5157-1","openSUSE-SU-2024:12306-1"],"status":"published","title":"GNU Mailman Postorius Access Control Issues","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01209,"percentile":0.68616,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2021-09-09T00:00:00Z","modified":"2026-10-23T18:04:51Z","fixes":[{"ecosystem":"PyPI","package":"postorius","fixed_in":["1.3.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"postorius","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"postorius","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postorius","fixed_in":["1.3.5-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"postorius","fixed_in":["1.2.4-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"postorius","fixed_in":["1.3.4-2+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"postorius","fixed_in":["1.1.2-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"postorius","fixed_in":["1.2.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"postorius","fixed_in":["1.3.5-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1+deb10u1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Debian:11","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-2+deb11u1"}]}],"versions":["1.3.4-2"]},{"source":"osv","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.2.0a1","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.1","1.3.2","1.3.3","1.3.3rc1","1.3.3rc2","1.3.4","1.3.4rc1"]},{"source":"osv","ecosystem":"PyPI","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5"}]}],"versions":["1.0.0","1.0.0a1","1.0.0a2","1.0.0b1","1.0.0b2","1.0.0b3","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.2.0","1.2.0a1","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.1","1.3.2","1.3.3","1.3.3rc1","1.3.3rc2","1.3.4","1.3.4rc1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3ubuntu0.1"}]}],"versions":["1.1.0-1","1.1.1-1","1.1.2-1","1.1.2-2","1.1.2-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-1"}]}],"versions":["1.3.4-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3ubuntu0.1"}]}],"versions":["1.1.0-1","1.1.1-1","1.1.2-1","1.1.2-2","1.1.2-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postorius","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1"}]}],"versions":["1.2.4-1"]}],"products":[{"vendor":"postorius_project","product":"postorius"}],"references":[{"url":"https://gitlab.com/mailman/postorius/-/issues/531","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://phabricator.wikimedia.org/T289798","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://gitlab.com/mailman/postorius/-/tags","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4970","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40347","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/postorius/PYSEC-2021-319.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v83x-78q3-gr2j","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-40347","tags":["advisory"]},{"url":"https://gitlab.com/mailman/postorius","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-40347","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5157-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40347","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40347","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-40347","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T18:17:24Z","modified":"2024-08-04T02:27:31.978Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-0197","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T18:17:24Z","modified":"2024-08-04T02:27:31Z","updated_at":"2026-11-03T03:24:21.368958Z"}],"ghsa":[{"id":"GHSA-v83x-78q3-gr2j","title":"GNU Mailman Postorius Access Control Issues","description":"An issue was discovered in `views/list.py` in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2022-05-24T19:14:08Z","modified":"2024-10-21T20:10:57Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:38:12.325695Z"}],"nvd":[{"id":"CVE-2021-40347","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T19:15:08.163Z","modified":"2026-06-17T04:06:46.343Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-40347","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T19:15:08.163Z","modified":"2026-10-20T10:54:58.007090669Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-40347","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T19:15:08.163Z","modified":"2026-10-23T18:04:51.120927184Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-v83x-78q3-gr2j","title":"GNU Mailman Postorius Access Control Issues","description":"An issue was discovered in `views/list.py` in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2022-05-24T19:14:08Z","modified":"2024-10-21T20:26:03.468341Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"UBUNTU-CVE-2021-40347","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T19:15:00Z","modified":"2026-02-04T03:50:34.841703Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"DSA-4970-1","title":"postorius - security update","status":"published","published":"2021-09-09T00:00:00Z","modified":"2026-03-09T02:09:27.112349Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2024:12306-1","title":"postorius-1.3.6-1.1 on GA media","description":"These are all security issues fixed in the postorius-1.3.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:30:37.787723Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2021-319","description":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.","status":"published","published":"2021-09-10T19:15:00Z","modified":"2026-06-10T17:01:35.187803742Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"USN-5157-1","title":"postorius vulnerability","description":"It was discovered that Postorius mishandled specially crafted input. An\nattacker could use this vulnerability that obtain sensitive information.\n","status":"published","published":"2021-11-25T19:46:37Z","modified":"2026-02-10T04:42:23Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}