Zero-Click pretalx XSS Flaw Lets Hackers Hijack Conference Organizer Accounts
Cybersecurity researchers at the firm Novee Security have discovered a dangerous flaw in pretalx, a popular open-source software, which allows cybercriminals to completely hijack organiser accounts without having to click a single link. It is a high-severity stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-41241 with a high CVSS score of 8.7.
For your information, pretalx is widely used to run Call for Papers (CFP) processes and scheduling for everything from hacker camps to academic symposiums. The vulnerability was analyzed by Elad Meged, a founding engineer and security researcher at Novee, who noticed that while different events look independent from the outside, they run on the same underlying codebase. This means a single flaw creates systemic exposure across the industry.
Bypassing Content Security Policies
Novee’s blog post, shared with Hackread.com, reveals that the attack vector requires low privileges and low complexity, so any registered user can exploit it simply...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
