January 2026 - Mailman-users - lists.mailman3.org

Change Member's Address
by dap1＠bellsouth.net Jan. 15, 2026

Jan. 15, 2026

How do I manually change a member's address? I can't find any way to do that from the mailman-web pages. Do I need to do it within MySQL somewhere? TIA.

6 18

Any known cases of "non-members" who aren't explicitly allowed to send to the list with a default rule of "discard" on a list getting through?
by Thomas Ward Jan. 10, 2026

Jan. 10, 2026

We just noticed an oddness in a client's system. Someone sent to a members-only list and it 'got past' moderation controls. The list is set to not allow non-members to send to the list, but somehow it got through the default rule of "discard (no notification)" for a non-member and got to the list. The only oddness I can tell is that there was an emoji (unicode) in the subject line but as I understand how Mailman works, this should NOT have impacted anything, as the sender filter bits happen earlier in message processing. Has *anyone* seen any cases like this before? If this is repeatable or a known issue, it deserves a CVE security bug because this is a **severe** problem.

3 2

Unadvertised lists accessible even if not signed in
by Peter Chubb Jan. 5, 2026

Jan. 5, 2026

Hi folks, I'm running Mailman3 3.3.10, with postorius and hyperkitty. I want unadvertised lists to be visible only to the people who are subscribed to them and to site administrators. Right now, anyone who has the name of a list can construct a URL to the signup page, even for unadvertised lists. So, I can go to: https://site.name/postorius/lists/test.site.name/ and get to the test list, even if it is unadvertised. I see people scanning URLs like this in the NGINX logs, looking for lists. How can I prevent anyone not logged in, and not a member of an unadvertised list, from seeing it? Peter C

2 1

Getting original message headers
by Peter Chubb Jan. 5, 2026

Jan. 5, 2026

We've been seeing some particularly pernicious spammers recently. They're using gmail accounts; I'd like to report them to Google. To do that I need to find the original message headers. By the time the message gets to the archive, or to the mailing list recipients, all the Received: headers seem to have been deleted, leaving only the ones from my list server outwards. Is there a way to access the original incoming emai, before DMARC mitigation etc., has changed the headers? Peter C

3 5