{"action":"Upgrade postorius to 1.3.5 or later.","affected":[{"fixed":"1.3.5","introduced":"0"}],"component":"postorius","cve_ids":["CVE-2021-40347"],"ecosystem":"PyPI","epss":0.01186,"exploited":false,"fixed_versions":["1.3.5"],"ghsa_id":"GHSA-v83x-78q3-gr2j","id":"tcs_01M5KGCB2Z3S38MG542D17T53Q","modified_at":"2026-06-10T17:01:35.187803742Z","published_at":"2021-09-10T19:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-319","https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b","https://gitlab.com/mailman/postorius/-/tags","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746","https://gitlab.com/mailman/postorius/-/issues/531","https://phabricator.wikimedia.org/T289798","https://www.debian.org/security/2021/dsa-4970","https://github.com/advisories/GHSA-v83x-78q3-gr2j"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-319","url":"https://osv.dev/vulnerability/PYSEC-2021-319"}],"summary":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also"}