Description
The confirm add-on in SmartList 3.15 and earlier allows attackers to subscribe arbitrary e-mail addresses by using a valid cookie that specifies an address other than the address for which the cookie was assigned.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | smartlist | 3.15-18 | — |
| Debian 13 | smartlist | 3.15-18 | — |
| Debian 12 | smartlist | 3.15-18 | — |
| Debian 3.0 | smartlist | 3.15-5.woody.1 | DSA-720-1 |
Advisories 1
- DSA-720-1 smartlist - wrong input processing Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-720 vendor-advisory