Description
The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3) do_arc_delete functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sympa | 6.1.11~dfsg-1 | — |
| Debian 13 | sympa | 6.1.11~dfsg-1 | — |
| Debian 12 | sympa | 6.1.11~dfsg-1 | — |
| Debian 6.0 | sympa | 6.0.1+dfsg-4+squeeze1 | DSA-2477-1 |
Advisories 1
- DSA-2477-1 sympa - authorization bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://sourcesup.renater.fr/scm/viewvc.php/branches/sympa-6.0-branch/wwsympa/wwsympa.fcgi.in?root=sympa&r1=6706&r2=7358&pathrev=7358
- DSA-2477 vendor-advisory
- [oss-security] 20120512 Re: CVE request: sympa (try again) mailing-list
- 53503 vdb-entry
- [oss-security] 20120511 CVE request: sympa (try again) mailing-list
- [oss-security] 20120511 Re: CVE request: sympa (try again) mailing-list
- 81890 vdb-entry
- https://www.sympa.org/distribution/latest-stable/NEWS
- 49045 third-party-advisory
- 49237 third-party-advisory