Vulnerabilities > CVE-2025-43921 - Incorrect Authorization vulnerability in GNU Mailman

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

gnu

CWE-863

NVD

Published: 2025-04-20

Updated: 2025-04-28

Summary

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to reproduce this, regardless of whether cPanel or WHM is used.

Vulnerable Configurations

Part	Description	Count
Application	Gnu GNU Mailman 2.1.1 GNU Mailman 2.1.2 GNU Mailman 2.1.3 GNU Mailman 2.1.4 GNU Mailman 2.1.5 GNU Mailman 2.1.5.8 GNU Mailman 2.1.6 GNU Mailman 2.1.7 GNU Mailman 2.1.8 GNU Mailman 2.1.9 GNU Mailman 2.1.10 GNU Mailman 2.1.10B1 GNU Mailman 2.1.10B3 GNU Mailman 2.1.10B4 GNU Mailman 2.1.11 GNU Mailman 2.1.12 GNU Mailman 2.1.13 GNU Mailman 2.1.14 GNU Mailman 2.1.14-1 GNU Mailman 2.1.15 GNU Mailman 2.1.16 GNU Mailman 2.1.17 GNU Mailman 2.1.18 GNU Mailman 2.1.18-1 GNU Mailman 2.1.19 GNU Mailman 2.1.20 GNU Mailman 2.1.21 GNU Mailman 2.1.22 GNU Mailman 2.1.23 GNU Mailman 2.1.24 GNU Mailman 2.1.25 GNU Mailman 2.1.26 GNU Mailman 2.1.27 GNU Mailman 2.1.28 GNU Mailman 2.1.29 GNU Mailman 2.1.30 GNU Mailman 2.1.31 GNU Mailman 2.1.33 GNU Mailman 2.1.34 GNU Mailman 2.1.35 GNU Mailman 2.1.36 GNU Mailman 2.1.37	61

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References