Vendor
pretix
40 known vulnerabilities.
Products
19 results · Clear filters · Feed
-
Low 1.2
Missing permission check in ticket layout API
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
-
Low 2.3
Incorrect session validation for API-created shredder exports
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creatin…
-
Low 2.1
OAuth credentials not disabled when application is disabled
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
-
Low 2.1
HTML injection
Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
-
Low 2.3
Incorrect session validation for API-uploaded files
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for …
-
Low 1.7
Customer session fixation
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attac…
-
Low 2.7
Revenue information leak
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
-
Low 1.3
Checkout validation bypass
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
-
Low 2.3
Missing authorization check in event quick setup view
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An…
-
Low 2.3
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't …
-
Low 2.1
Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since…
-
Low 2.1
Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src…
-
Low 2.1
Stored XSS in pretix-pages
Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.
-
Low 2.0
Stored XSS in pretix-digital
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
-
Low 3.6
Data exposed without proper permission
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first lett…
-
Low 3.8
Insecure direct object reference
When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The s…
-
Low 3.8
Insecure direct object reference
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
-
Low 3.8
Insecure direct object reference
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
-
Low 2.4
Limited HTML injection in emails
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown…