A flaw in the reporting function of Venueless allows a user who holds the "update world" permission to read private conversations from other worlds on the same server. The bug permits extraction of both direct message and channel chat histories, enabling an insider to obtain sensitive information that should be confined to the original participants. The vulnerability is rooted in insufficient input validation when handling chat channel identifiers.

All installations of Pretix Venueless where the update world permission is granted to a user. No specific version is listed, so any deployment that has not applied the published fix is potentially affected.

The CVSS score of 7.3 indicates a high severity. Exploitation requires a user to obtain the internal UUID of the target chat channel, which is unlikely to be exposed to external actors; therefore the risk is mainly from privileged users or compromised accounts. The EPSS score is not available and the vulnerability is not currently in the CISA KEV list, reducing the likelihood of widespread deployment. Nonetheless, the presence of a privilege escalation vector and the ability to read private conversation data makes it a significant threat for organizations relying on Venueless for secure event communication.