PT-2026-31303 · Pretix · Pretix

Pratik Karan · Published 2026-04-08 · Updated 2026-04-12 · CVE-2026-5600

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions pretix version 2025

Description A new API endpoint in pretix 2025 incorrectly returns all check-in events belonging to the organizer instead of the specific event. This allows an API consumer to access information for all events under the same organizer, even those they should not have access to. The records contain information on the time and result of every ticket scan, as well as the ID of the matched ticket. The API response includes details such as id, successful, error reason, position, datetime, list, created, auto checked in, gate, device, device id, and type.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the affected API endpoint.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-5600

GHSA-WR8Q-C73G-M7GP

PYSEC-2026-111

Affected Products

Pretix

References · 8

• https://pretix.eu/about/en/blog/20260408-release-2026-3-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wr8q-c73g-m7gp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5600 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-111 · Vendor Advisory
• https://github.com/pretix/pretix · Note
• https://t.me/CVEtracker/50054 · Telegram Post
• https://twitter.com/cyberbivash/status/2041864651751801080 · Twitter Post
• https://twitter.com/CVEnew/status/2043295661987069993 · Twitter Post