Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

pretix

20 known vulnerabilities (1 critical, 4 high, 5 medium, 8 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
20 · 1 critical, 4 high, 5 medium, 8 low
Weekly downloads
4,408
Dependents
11
Registry
PyPI

Advisories 20

  • CVE-2026-101274Medium 6.9

    When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate…

    Affected: fixed in 2026.6.4; from 2026.7.0, fixed in 2026.7.3; from 2026.8.0, fixed in 2026.8.1.

  • CVE-2026-101273Medium 5.3

    Giftcard enumeration

    Affected: fixed in 2026.6.4; from 2026.7.0, fixed in 2026.7.3; from 2026.8.0, fixed in 2026.8.1.

  • Missing authorization check in event quick setup view

    Affected: fixed in 2026.4.6; from 2026.5.0, fixed in 2026.5.4; from 2026.6.0, fixed in 2026.6.1.

  • Session takeover vulnerability

    Affected: from 4.14.0, fixed in 2026.3.5; from 2026.4.0, fixed in 2026.4.5; from 2026.5.0, fixed in 2026.5.3.

  • Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in…

    Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2.

  • Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.

    Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2.

  • Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.

    Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2.

  • CVE-2026-13225Medium 5.3

    Stored XSS in ticket confirmation page

    Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2.

  • Data exposed without proper permission

    Affected: from 2024.1.0, fixed in 2026.3.0; from 2026.3.0, fixed in 2026.3.3; from 2026.4.0, fixed in 2026.4.3; from 2026.5.0, fixed in 2026.5.1.

  • Insecure direct object reference

    Affected: from 2024.10.0, fixed in 2026.2.0; from 2026.2.0, fixed in 2026.2.2; from 2026.3.0, fixed in 2026.3.2; from 2026.4.0, fixed in 2026.4.2; fixed in 2026.4.2.

  • CVE-2026-5600Medium 5.5

    A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all…

    Affected: from 2025.10.0, fixed in 2026.1.2; from 2026.2.0, fixed in 2026.2.1; from 2026.3.0, fixed in 2026.3.1; from 2025.10.0, fixed in 2026.1.2; from 2026.2.0, fixed in 2026.2.1; from 2026.3.0, fixed in 2026.3.1; from 2026.3.0, fixed in 2026.3.1; from 2026.2.0, fixed in 2026.2.1; from 2025.10.0, fixed in 2026.1.2.

  • Unsafe variable evaluation in email templates

    Affected: from 4.16.0, fixed in 2025.9.0; from 2025.9.0, fixed in 2025.9.4; from 2025.10.0, fixed in 2025.10.2; from 2026.1.0, fixed in 2026.1.1; from 2026.1.0, fixed in 2026.1.1; from 2025.10.0, fixed in 2025.10.2; fixed in 2025.9.4; from 4.16.0, fixed in 2026.1.1.

  • Insecure direct object reference

    Affected: from 1.0.0, fixed in 2025.8.0; from 2025.8.0, fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1; from 2025.10.0, fixed in 2025.10.1; from 2025.9.0, fixed in 2025.9.3; fixed in 2025.8.3; fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1.

  • Insecure direct object reference

    Affected: fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1; from 2025.10.0, fixed in 2025.10.1; from 2025.9.0, fixed in 2025.9.3; fixed in 2025.8.3.

  • Limited HTML injection in emails

    Affected: from 1.0.0, fixed in 2025.7.0; from 2025.7.0, fixed in 2025.7.2; from 2025.8.0, fixed in 2025.8.1; from 2025.9.0, fixed in 2025.9.1; from 1.0.0, fixed in 2025.7.2; from 1.0.0, fixed in 2025.7.3; from 2025.8.0, fixed in 2025.8.2; from 2025.9.0, fixed in 2025.9.2.

Show all 20 advisoriesShow fewer advisories

  • Stored XSS in Placeholder Samples in Mail Preview

    Affected: fixed in 2024.4.1; fixed in 2024.7.1.

  • CVE-2024-27447Critical 9.8

    pretix before 2024.1.1 mishandles file validation.

    Affected: fixed in 2024.1.1.

  • CVE-2023-44463Medium 5.3

    An issue was discovered in pretix before 2023.7.1.

    Affected: fixed in 2023.7.1; fixed in 2023.7.1.

  • pretix before 2023.7.2 allows Pillow to parse EPS files.

    Affected: fixed in 2023.7.2.

  • rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session.

    Affected: from 4.17.0, fixed in 4.17.1; from 4.16.0, fixed in 4.16.1; fixed in 4.15.1; fixed in 4.17.1.