Read the docs
TI-2026-04908 Aliases CVE-2026-5600GHSA-wr8q-c73g-m7gp

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in…

Priority LOW 24CWE-653Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" } An unauthorized user usually has no way to match these IDs (position) back to individual people.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2026.1.2, 2026.2.1, 2026.3.1pretix (PyPI): 2026.3.1, 2026.2.1, 2026.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pretixpretix2025.10.0 to before 2026.1.2; 2026.2.0 to before 2026.2.1; 2026.3.0 to before 2026.3.12026.1.2, 2026.2.1, 2026.3.1Patch availableCNA
—pretix (PyPI)2026.3.0 to before 2026.3.12026.3.1Patch availableGHSA-wr8q-c73g-m7gp
—pretix (PyPI)2026.2.0 to before 2026.2.12026.2.1Patch availableGHSA-wr8q-c73g-m7gp
—pretix (PyPI)2025.10.0 to before 2026.1.22026.1.2Patch availableGHSA-wr8q-c73g-m7gp
  • pretix Vendorpretix Affected 2025.10.0 to before 2026.1.2; 2026.2.0 to before 2026.2.1; 2026.3.0 to before 2026.3.1 Fixed in 2026.1.2, 2026.2.1, 2026.3.1 Patch available CNA
  • pretix (PyPI) Vendor— Affected 2026.3.0 to before 2026.3.1 Fixed in 2026.3.1 Patch available GHSA-wr8q-c73g-m7gp
  • pretix (PyPI) Vendor— Affected 2026.2.0 to before 2026.2.1 Fixed in 2026.2.1 Patch available GHSA-wr8q-c73g-m7gp
  • pretix (PyPI) Vendor— Affected 2025.10.0 to before 2026.1.2 Fixed in 2026.1.2 Patch available GHSA-wr8q-c73g-m7gp

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*2025.10.0 to before 2026.1.2; 2026.2.0 to before 2026.2.1; 2026.3.0 to before 2026.3.1Vulnerablepretix
  • cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions 2025.10.0 to before 2026.1.2; 2026.2.0 to before 2026.2.1; 2026.3.0 to before 2026.3.1 Vulnerable ·pretix

Remediation

  • Fix · CNA pretix (pretix) Fixed in 2026.1.2, 2026.2.1, 2026.3.1
  • Fix · GHSA-wr8q-c73g-m7gp pretix (PyPI) Fixed in 2026.3.1 Advisory →
  • Fix · GHSA-wr8q-c73g-m7gp pretix (PyPI) Fixed in 2026.2.1 Advisory →
  • Fix · GHSA-wr8q-c73g-m7gp pretix (PyPI) Fixed in 2026.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5600
  2. 2026-10-03 Alias added: GHSA-wr8q-c73g-m7gp

References

Advisory 2

Other 3

  • TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
  • TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2026-02048 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2024-07522 Stored XSS in Placeholder Samples in Mail Preview CVSS 4.0HIGH 7.2
  • TI-2025-12562 Limited HTML injection in emails CVSS 4.0LOW 2.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences