Vulnerabilities

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users.

When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured gr…

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID.

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users.

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account.

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information.

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks.

Our payment integration with GiroCheckout did not properly validate payment status responses.

We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system),…

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology.

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser.

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

Our payment integration with Mollie did not properly validate payment status responses.

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses.

Our payment integration with Computop-based payment methods did not properly validate payment status responses.

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.