Pratik Karan

Name of the Vulnerable Software and Affected Versions pretix version 2025 Description A new API endpoint in pretix 2025 incorrectly returns all check-in events belonging to the organizer instead of the specific event. This allows an API consumer to access information for all events under the same organizer, even those they should not have access to. The records contain information on the time and result of every ticket scan, as well as the ID of the matched ticket. The API response includes details such as `id`, `successful`, `error reason`, `position`, `datetime`, `list`, `created`, `auto checked in`, `gate`, `device`, `device id`, and `type`. Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the affected API endpoint.

Name of the Vulnerable Software and Affected Versions venueless versions (affected versions not specified) Description A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds. The issue involves the ability to delete user accounts across different instances via the API. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Venueless (affected versions not specified) **Description** A user possessing the "update world" permission within any Venueless world can potentially extract chat messages from direct messages or channels in other worlds on the same server. This is attributed to a flaw in the reporting functionality. The ability to successfully exploit this issue is limited as it requires knowledge of the internal channel UUID of the target chat channel, which is not easily accessible to external attackers, particularly for direct messages. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.