PT-2026-8332 · Pretix · Pretix

Published 2026-02-16 · Updated 2026-03-13 · CVE-2026-2451

Positive Technologies · (AI Summary)

CVSS v4.0

7.5

High

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/RE:L/U:Red

Name of the Vulnerable Software and Affected Versions pretix (affected versions not specified)

Description The software allows the use of placeholders in email templates that are populated with customer data. A flaw exists where specially crafted placeholder names, such as {{event. init . code .co filename}}, can be used to extract information from the pretix system. An attacker who can control email templates, typically any user of the pretix backend, could potentially retrieve sensitive information from the system configuration, including database passwords and API keys. Existing preventative mechanisms within pretix were not fully effective in this instance.

Recommendations Rotate all passwords and API keys contained in your pretix.cfg file.

Fix

Weakness Enumeration

CWE-627

Related Identifiers

CVE-2026-2451

Affected Products

Pretix

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2451 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2451 · Vendor Advisory
• https://t.me/cveNotify/155386 · Telegram Post
• https://t.me/CVEtracker/44810 · Telegram Post
• https://pretix.eu/about/en/blog/20260216-release-2026-1-1 · Patch, Vendor Advisory
• https://t.me/cveNotify/152108 · Telegram Post