{"action":"Upgrade postorius to 1.3.5-1 or later.","affected":[{"fixed":"1.3.5-1","introduced":"0"}],"component":"postorius","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.3.5-1"],"id":"tcs_01M5NFYYA89DD8TCK8A2WE8P2B","modified_at":"2026-10-23T18:04:51.120927184Z","published_at":"2021-09-10T19:15:08.163Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-40347","https://security-tracker.debian.org/tracker/CVE-2021-40347"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-40347#Debian:14/postorius","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-40347"}],"summary":"An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also"}