CVE-2026-4982 Unauthorized access to chat contents
An attacker with update world permissions can exfiltrate chat messages from other worlds if they know the internal channel UUID.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4982?
CVE-2026-4982 is a high-severity missing authorization vulnerability in pretix Venueless, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature.
The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.
Weakness: CWE-20
Which versions are affected by CVE-2026-4982?
How do I fix CVE-2026-4982?
No fix has been published for CVE-2026-4982 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-4982 being exploited?
There is no known exploitation of CVE-2026-4982 in the wild and no public exploit code.