Read the docs
TI-2023-12482 Aliases CVE-2023-27891GHSA-r76w-3wwq-jv6v

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out…

Priority LOW 34CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00623 50th percentileScored 2026-11-07
Fix Fixed pretix (PyPI): 4.17.1, 4.16.1, 4.15.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pretix (PyPI)4.17.0 to before 4.17.14.17.1Patch availableGHSA-r76w-3wwq-jv6v
—pretix (PyPI)4.16.0 to before 4.16.14.16.1Patch availableGHSA-r76w-3wwq-jv6v
—pretix (PyPI)before 4.15.14.15.1Patch availableGHSA-r76w-3wwq-jv6v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pretix (PyPI) Vendor— Affected 4.17.0 to before 4.17.1 Fixed in 4.17.1 Patch available GHSA-r76w-3wwq-jv6v
  • pretix (PyPI) Vendor— Affected 4.16.0 to before 4.16.1 Fixed in 4.16.1 Patch available GHSA-r76w-3wwq-jv6v
  • pretix (PyPI) Vendor— Affected before 4.15.1 Fixed in 4.15.1 Patch available GHSA-r76w-3wwq-jv6v

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:rami:pretix:*:*:*:*:*:*:*:*1.16.0 to before 4.15.1VulnerableRami
cpe:2.3:a:rami:pretix:4.16.0:*:*:*:*:*:*:*4.16.0VulnerableRami
cpe:2.3:a:rami:pretix:4.17.0:*:*:*:*:*:*:*4.17.0VulnerableRami
  • cpe:2.3:a:rami:pretix:*:*:*:*:*:*:*:* Versions 1.16.0 to before 4.15.1 Vulnerable ·Rami
  • cpe:2.3:a:rami:pretix:4.16.0:*:*:*:*:*:*:* Versions 4.16.0 Vulnerable ·Rami
  • cpe:2.3:a:rami:pretix:4.17.0:*:*:*:*:*:*:* Versions 4.17.0 Vulnerable ·Rami

Remediation

  • Fix · GHSA-r76w-3wwq-jv6v pretix (PyPI) Fixed in 4.17.1 Advisory →
  • Fix · GHSA-r76w-3wwq-jv6v pretix (PyPI) Fixed in 4.16.1 Advisory →
  • Fix · GHSA-r76w-3wwq-jv6v pretix (PyPI) Fixed in 4.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-27891
  2. 2026-10-03 Alias added: GHSA-r76w-3wwq-jv6v
  3. 2026-10-29 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 3

  • TI-2023-23960 pretix before 2023.7.2 allows Pillow to parse EPS files. CVSS 3.1HIGH 7.8
  • TI-2023-23959 An issue was discovered in pretix before 2023.7.1. CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences