Pretix
by Pretix
Source repositories
CVEs (26)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-27447 | Cri | 0.64 | 9.8 | 0.01 | Feb 26, 2024 | pretix before 2024.1.1 mishandles file validation. | ||
| CVE-2026-13603 | Cri | 0.52 | — | 0.00 | Jul 1, 2026 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the… | ||
| CVE-2023-44464 | Hig | 0.44 | 7.8 | 0.00 | Sep 29, 2023 | pretix before 2023.7.2 allows Pillow to parse EPS files. | ||
| CVE-2026-13602 | Hig | 0.43 | — | 0.00 | Jul 1, 2026 | We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bitpay,… | ||
| CVE-2026-2452 | Med | 0.42 | 6.5 | 0.00 | Feb 16, 2026 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to… | ||
| CVE-2026-2451 | Med | 0.42 | 6.5 | 0.00 | Feb 16, 2026 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to… | ||
| CVE-2026-13223 | Med | 0.34 | — | 0.00 | Jun 25, 2026 | Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid … | ||
| CVE-2026-13222 | Med | 0.34 | — | 0.00 | Jun 25, 2026 | Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid … | ||
| CVE-2025-13742 | Med | 0.33 | 6.1 | 0.00 | Nov 27, 2025 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this… | ||
| CVE-2026-2415 | Med | 0.31 | 5.9 | 0.00 | Feb 16, 2026 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs: * It was… | ||
| CVE-2024-8113 | Med | 0.28 | 5.4 | 0.00 | Aug 23, 2024 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation… | ||
| CVE-2026-13225 | Med | 0.27 | — | 0.00 | Jun 25, 2026 | Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order. | ||
| CVE-2023-44463 | Med | 0.27 | 5.3 | 0.01 | Oct 2, 2023 | An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application. | ||
| CVE-2026-5600 | Med | 0.21 | 4.3 | 0.00 | Apr 8, 2026 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same … | ||
| CVE-2026-9712 | Low | 0.18 | — | 0.00 | May 27, 2026 | When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID… | ||
| CVE-2025-14882 | Low | 0.18 | — | 0.00 | Dec 19, 2025 | An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | ||
| CVE-2025-14881 | Low | 0.18 | — | 0.00 | Dec 19, 2025 | Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | ||
| CVE-2026-11764 | Low | 0.16 | — | 0.00 | Jun 9, 2026 | When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift… | ||
| CVE-2026-18029 | Med | 0.00 | — | 0.00 | Jul 28, 2026 | Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only … | ||
| CVE-2026-18028 | Low | 0.00 | — | 0.00 | Jul 28, 2026 | The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could… |
- risk 0.64cvss 9.8epss 0.01
pretix before 2024.1.1 mishandles file validation.
- risk 0.52cvss —epss 0.00
The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the…
- risk 0.44cvss 7.8epss 0.00
pretix before 2023.7.2 allows Pillow to parse EPS files.
- risk 0.43cvss —epss 0.00
We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bitpay,…
- risk 0.42cvss 6.5epss 0.00
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to…
- risk 0.42cvss 6.5epss 0.00
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to…
- risk 0.34cvss —epss 0.00
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid …
- risk 0.34cvss —epss 0.00
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid …
- risk 0.33cvss 6.1epss 0.00
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this…
- risk 0.31cvss 5.9epss 0.00
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs: * It was…
- risk 0.28cvss 5.4epss 0.00
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation…
- risk 0.27cvss —epss 0.00
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
- risk 0.27cvss 5.3epss 0.01
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.
- risk 0.21cvss 4.3epss 0.00
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same …
- risk 0.18cvss —epss 0.00
When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID…
- risk 0.18cvss —epss 0.00
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
- risk 0.18cvss —epss 0.00
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
- risk 0.16cvss —epss 0.00
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift…
- risk 0.00cvss —epss 0.00
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only …
- risk 0.00cvss —epss 0.00
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could…
Page 1 of 2