Vulnerabilities

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Emails sent by pretix can utilize placeholders that will be filled with customer data.

Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page.

pretix before 2024.1.1 mishandles file validation.