Novee Security researchers identified a stored XSS vulnerability in Pretalx, tracked as CVE-2026-41241. The vulnerability exploited the ability of registered speakers to upload materials and the way search results are displayed, enabling full JavaScript execution in an organizer's browser. This allowed attackers to silently compromise organizer accounts when they searched for maliciously crafted submissions. The impact included the potential for attackers to automate talk acceptance across multiple conferences using Pretalx. The vulnerability has been officially patched in Pretalx version 2026.1.0.

Successful exploitation results in organizer account takeover without additional user interaction, enabling attackers to manipulate conference talk acceptance processes. Because Pretalx is widely used across many conferences, the vulnerability could be leveraged simultaneously across multiple deployments. This could lead to unauthorized acceptance of malicious or undeserved talk proposals. There are no known exploits in the wild at this time.

An official patch addressing this vulnerability is available in Pretalx version 2026.1.0. Conference organizers and administrators should upgrade to this version promptly to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.