Pretix
12 CVEs across 17 Pretix products. Browse Pretix vulnerabilities, severities, and proof-of-concept exploits.
Pretix products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-13602 | | 2026-07-01 | We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: *… | |
CVE-2026-13603 | | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The in… | |
CVE-2026-13350 | | 2026-06-25 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. | |
CVE-2026-57536 | | 2026-06-25 | Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one p… | |
CVE-2026-57535 | | 2026-06-25 | Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to a… | |
CVE-2026-57534 | | 2026-06-25 | Malicious HTML content could be injected into the content of a page in the pretix-pages plugin. | |
CVE-2026-57533 | | 2026-06-25 | Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Poli… | |
CVE-2026-57532 | | 2026-06-25 | Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This… | |
CVE-2026-13314 | | 2026-06-25 | Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. | |
CVE-2026-13225 | | 2026-06-25 | Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual… | |
CVE-2026-13223 | | 2026-06-25 | Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment st… | |
CVE-2026-13222 | | 2026-06-25 | Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment statu… | |
CVE-2026-12863 | | 2026-06-22 | An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains. | |
CVE-2026-12862 | | 2026-06-22 | Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of… | |
CVE-2026-11764 | | 2026-06-09 | When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not… | |
CVE-2026-9712 | | 2026-05-27 | When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-83… | |
CVE-2026-5600 | Medium | 4.3 | 2026-04-08 | A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging… |
CVE-2026-5599 | | 2026-04-05 | A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds. | |
CVE-2026-4982 | | 2026-03-27 | A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same s… | |
CVE-2026-2452 | Medium | 6.5 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2026-2451 | Medium | 6.5 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2026-2415 | Medium | 5.9 | 2026-02-16 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be repl… |
CVE-2025-14882 | | 2025-12-19 | An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-14881 | | 2025-12-19 | Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | |
CVE-2025-13742 | Medium | 6.1 | 2025-11-27 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replac… |
CVE-2024-8113 | Medium | 5.4 | 2024-08-23 | Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page… |
CVE-2024-27447 | Critical | 9.8 | 2024-02-26 | pretix before 2024.1.1 mishandles file validation. |