Vulnerabilidades do Pretix Venueless
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Pretix Venueless: 5 registro(s), com versões afetadas e correções.
CVE-2026-13350
Baixa · 2.3
CWE-639 25/06/2026
Authorization Bypass Through User-Controlled Key (IDOR) em Pretix Venueless
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
CVE-2026-12863
Média · 5.1
CWE-601 22/06/2026
Open redirect
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
CVE-2026-12862
Média · 5.1
CWE-148 22/06/2026
XLSX formula injection in exports
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
CVE-2026-5599
Alta · 7.3
CWE-653 05/04/2026
API allows deletion of users of other instance
A user with API access and "manage users" permission in any venueless
world is able to trigger deletion of user accounts in other worlds.
CVE-2026-4982
Alta · 7.3
CWE-20 27/03/2026
Unauthorized access to chat contents
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature.
The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.