PT-2026-28703 · Venueless · Venueless

Pratik Karan · Published 2026-03-27 · Updated 2026-03-27 · CVE-2026-4982

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Venueless (affected versions not specified)

Description A user possessing the "update world" permission within any Venueless world can potentially extract chat messages from direct messages or channels in other worlds on the same server. This is attributed to a flaw in the reporting functionality. The ability to successfully exploit this issue is limited as it requires knowledge of the internal channel UUID of the target chat channel, which is not easily accessible to external attackers, particularly for direct messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-4982

Affected Products

Venueless

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-4982 · Security Note
• https://github.com/venueless/venueless/security/advisories/GHSA-6fq7-pgj3-6cfp · Note
• https://twitter.com/cyberbivash/status/2037550593086988333 · Twitter Post