Pretix vulnerabilities

CVE-2026-101267 [LOW] CWE-862 CVE-2026-101267: A missing permission check allowed low-privileged users with access to an event but without access t A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

CVE-2026-101268 [LOW] CWE-384 CVE-2026-101268: If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

CVE-2026-101271 [LOW] CWE-613 CVE-2026-101271: OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the applicat OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

CVE-2026-57533 [LOW] CWE-80 CVE-2026-57533: Malicious HTML content could be injected into the page pretix shows when redirection to an untruste Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

CVE-2026-101270 [LOW] CWE-79 CVE-2026-101270: Malicious HTML content could be injected into the help texts of various fields with organizer permis Malicious HTML content could be injected into the help texts of various fields with organizer permissions.