Pretix Venueless vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Pretix Venueless: 5 record(s), with affected versions and fixes.
CVE-2026-13350
Low · 2.3
CWE-639 Jun 25, 2026
Authorization Bypass Through User-Controlled Key (IDOR) in Pretix Venueless
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
CVE-2026-12863
Medium · 5.1
CWE-601 Jun 22, 2026
Open redirect
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
CVE-2026-12862
Medium · 5.1
CWE-148 Jun 22, 2026
XLSX formula injection in exports
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
CVE-2026-5599
High · 7.3
CWE-653 Apr 5, 2026
API allows deletion of users of other instance
A user with API access and "manage users" permission in any venueless
world is able to trigger deletion of user accounts in other worlds.
CVE-2026-4982
High · 7.3
CWE-20 Mar 27, 2026
Unauthorized access to chat contents
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature.
The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.