Vulnerability · Published Mar 27, 2026 · Assigned by rami.io

CVE-2026-4982Unauthorized access to chat contents

High 7.3

In plain English

A high-severity improper input validation in Venueless from pretix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 4.0)7.3High

Exploit odds (30 days)0.2%top 85.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.

Affected products (as reported)

Vendor	Product	Versions
pretix	Venueless	0.0.0 – before 2026.3.27.e20083a

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

References

https://github.com/venueless/venueless/security/advisories/GHSA-6fq7-pgj3-6cfp