CVE-2026-41426

medium

Published 2026-04-24 · Modified 2026-05-20

CVSS v3

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2

—

VIR risk

6.1

Description

pretalx is a conference planning tool. Prior to 2026.1.0, an unauthenticated attacker can send arbitrary HTML-rendered emails from a pretalx instance's configured sender address by embedding malformed HTML or markdown link syntax in a user-controlled template placeholder such as the account display name. The most direct vector is the password-reset flow: the attacker registers an account with a malicious name, enters the victim's email address, and triggers a password reset. The resulting email is delivered from the event's legitimate sender address and passes SPF/DKIM/DMARC validation, making it a ready-made phishing vector. This vulnerability is fixed in 2026.1.0.

Predictions

Exploit likelihood

71%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security-advisories@github.com — https://github.com/pretalx/pretalx/security/advisories/GHSA-jm8c-9f3j-4378

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	pretalx	`<2026.1.0`	`2026.1.0`

Application impact

Vendor	Product	Versions	Fixed
pretalx	pretalx	`{"endExcluding":"2026.1.0"}`	`2026.1.0`

References

CWEs

CWE-79 CWE-116

Verify integrity in audit chain (admin only). AS-IS.