CVE-2026-41241Disclosure(pretalx / pretalx)

A serious security flaw (CVE-2026-41241) in pretalx — open-source software used to run conference submission and scheduling systems — lets any registered user hijack an organiser's account without the organiser clicking anything. The attack works by hiding malicious code inside a presentation submission title; when an organiser searches for talks, the code runs silently and can steal their session, accept talks automatically, or permanently strip their admin access. The flaw has been patched in pretalx version v2026.1.0, released 27 May 2026. If you run or organise a conference using pretalx, update to v2026.1.0 immediately — go to your server's admin panel or package manager and confirm the version number before accepting any new submissions. 🔥 #CyberNewsLive https://hackread.com/zero-click-pretalx-xss-hackers-hijack-conference-accounts/

🚨 #CVE-2026-41241: Pretalx Stored XSS Flaw Allowed Speakers to Hijack Organizer Sessions + Video -Fact Checker: ✅: 2 ❌: 0 || 2/2 http://undercodenews.com/cve-2026-41241-pretalx-stored-xss-flaw-allowed-speakers-to-hijack-organizer-sessions-video/

A security researcher found a flaw (CVE-2026-41241) in pretalx — open source software used by dozens of tech conferences to manage speaker submissions — that let anyone inject hidden code into the system by simply filling in a submission form. When a conference organiser searched for that entry, the hidden code ran silently in their browser, handing an attacker full control of the organiser's account. The researcher used it to get accepted as a speaker at 40 conferences simultaneously, but did not run a live attack on real systems. The flaw has been fixed in pretalx version 2026.1.0 — but the real risk is that a compromised conference platform becomes a launchpad for convincing phishing attacks against speakers, sponsors, and attendees who trust emails appearing to come from a legitimate event. ☠️ #CyberNewsLive https://theregister.com/security/2026/05/27/pretalx-xss-flaw-exposed-conference-cfp-systems/5246598

CVE-2026-41241 in Pretalx exposed a stored XSS flaw that let registered speakers run JavaScript in organizers' browsers during submission searches. Patched in 2026.1.0. #Pretalx #CVE202641241 #XSS https://ift.tt/XSj9ks0

CVE-2026-41241 pretalx is a conference planning tool. Prior to 2026.1.0, The organiser search in the pretalx backend rendered submission titles, speaker display names, and user name… https://www.cve.org/CVERecord?id=CVE-2026-41241