pretix

pretix before 2024.1.1 mishandles file validation.

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology.

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser.

We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system),…

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature.

Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page.

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured gr…

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.

Our payment integration with Mollie did not properly validate payment status responses.

Our payment integration with GiroCheckout did not properly validate payment status responses.

Our payment integration with Computop-based payment methods did not properly validate payment status responses.

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses.

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID.

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer.

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

Untrusted user data was passed verbatim to Excel exports for administrators.

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information.

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards.