Unauthorized access to chat contents
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00234 14th percentileScored 2026-11-07
Fix Fixed Venueless (pretix): 2026.3.27.e20083a
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Venueless (pretix) Fixed in 2026.3.27.e20083a
Timeline
- 2026-10-02 Threatist record created from CVE-2026-4982
More pretix vulnerabilities
- TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
- TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
- TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
- TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
- TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences