CVE-2026-4982
HighSummary
A user with 'update world' permission in any Venueless world can exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. Exploitation requires knowledge of the internal channel UUID.
Risk Assessment
Risk of private conversation leakage, potentially compromising communication confidentiality and user trust.
Recommendation
Restrict 'update world' permissions and apply vendor-provided patches to fix the reporting feature bug.
Other vulnerabilities in Venueless
See all- CVE-2026-82838Medium
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
- CVE-2026-5599High
A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.
Original NVD description (English source)
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.