# pretix (PyPI) vulnerabilities 20 known vulnerabilities (1 critical, 4 high, 5 medium, 8 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Weekly downloads: 4,408 - Dependents: 11 - Registry: https://pypi.org/project/pretix/ ## Advisories (20) ### [CVE-2026-101274](https://cve.now/CVE-2026-101274): When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate… - Severity: Medium 6.9 - Published: Oct 28, 2026 - Affected: fixed in 2026.6.4; from 2026.7.0, fixed in 2026.7.3; from 2026.8.0, fixed in 2026.8.1. ### [CVE-2026-101273](https://cve.now/CVE-2026-101273): Giftcard enumeration - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: fixed in 2026.6.4; from 2026.7.0, fixed in 2026.7.3; from 2026.8.0, fixed in 2026.8.1. ### [CVE-2026-18028](https://cve.now/CVE-2026-18028): Missing authorization check in event quick setup view - Severity: Low 2.3 - Published: Jul 28, 2026 - Affected: fixed in 2026.4.6; from 2026.5.0, fixed in 2026.5.4; from 2026.6.0, fixed in 2026.6.1. ### [CVE-2026-13602](https://cve.now/CVE-2026-13602): Session takeover vulnerability - Severity: High 7.7 - Published: Jul 1, 2026 - Affected: from 4.14.0, fixed in 2026.3.5; from 2026.4.0, fixed in 2026.4.5; from 2026.5.0, fixed in 2026.5.3. ### [CVE-2026-57532](https://cve.now/CVE-2026-57532): Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in… - Severity: High 8.8 - Published: Jun 25, 2026 - Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2. ### [CVE-2026-57533](https://cve.now/CVE-2026-57533): Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. - Severity: Low 2.1 - Published: Jun 25, 2026 - Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2. ### [CVE-2026-57535](https://cve.now/CVE-2026-57535): Content injected to PDF rendering contexts could, in many places, include HTML content including \ tags. - Severity: Low 2.1 - Published: Jun 25, 2026 - Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2. ### [CVE-2026-13225](https://cve.now/CVE-2026-13225): Stored XSS in ticket confirmation page - Severity: Medium 5.3 - Published: Jun 25, 2026 - Affected: fixed in 2026.3.4; from 2026.4.0, fixed in 2026.4.4; from 2026.5.0, fixed in 2026.5.2. ### [CVE-2026-11764](https://cve.now/CVE-2026-11764): Data exposed without proper permission - Severity: Low 3.6 - Published: Jun 9, 2026 - Affected: from 2024.1.0, fixed in 2026.3.0; from 2026.3.0, fixed in 2026.3.3; from 2026.4.0, fixed in 2026.4.3; from 2026.5.0, fixed in 2026.5.1. ### [CVE-2026-9712](https://cve.now/CVE-2026-9712): Insecure direct object reference - Severity: Low 3.8 - Published: May 27, 2026 - Affected: from 2024.10.0, fixed in 2026.2.0; from 2026.2.0, fixed in 2026.2.2; from 2026.3.0, fixed in 2026.3.2; from 2026.4.0, fixed in 2026.4.2; fixed in 2026.4.2. ### [CVE-2026-5600](https://cve.now/CVE-2026-5600): A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all… - Severity: Medium 5.5 - Published: Apr 8, 2026 - Affected: from 2025.10.0, fixed in 2026.1.2; from 2026.2.0, fixed in 2026.2.1; from 2026.3.0, fixed in 2026.3.1; from 2025.10.0, fixed in 2026.1.2; from 2026.2.0, fixed in 2026.2.1; from 2026.3.0, fixed in 2026.3.1; from 2026.3.0, fixed in 2026.3.1; from 2026.2.0, fixed in 2026.2.1; from 2025.10.0, fixed in 2026.1.2. ### [CVE-2026-2415](https://cve.now/CVE-2026-2415): Unsafe variable evaluation in email templates - Severity: High 7.5 - Published: Feb 16, 2026 - Affected: from 4.16.0, fixed in 2025.9.0; from 2025.9.0, fixed in 2025.9.4; from 2025.10.0, fixed in 2025.10.2; from 2026.1.0, fixed in 2026.1.1; from 2026.1.0, fixed in 2026.1.1; from 2025.10.0, fixed in 2025.10.2; fixed in 2025.9.4; from 4.16.0, fixed in 2026.1.1. ### [CVE-2025-14881](https://cve.now/CVE-2025-14881): Insecure direct object reference - Severity: Low 3.8 - Published: Dec 19, 2025 - Affected: from 1.0.0, fixed in 2025.8.0; from 2025.8.0, fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1; from 2025.10.0, fixed in 2025.10.1; from 2025.9.0, fixed in 2025.9.3; fixed in 2025.8.3; fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1. ### [CVE-2025-14882](https://cve.now/CVE-2025-14882): Insecure direct object reference - Severity: Low 3.8 - Published: Dec 19, 2025 - Affected: fixed in 2025.8.3; from 2025.9.0, fixed in 2025.9.3; from 2025.10.0, fixed in 2025.10.1; from 2025.10.0, fixed in 2025.10.1; from 2025.9.0, fixed in 2025.9.3; fixed in 2025.8.3. ### [CVE-2025-13742](https://cve.now/CVE-2025-13742): Limited HTML injection in emails - Severity: Low 2.4 - Published: Nov 27, 2025 - Affected: from 1.0.0, fixed in 2025.7.0; from 2025.7.0, fixed in 2025.7.2; from 2025.8.0, fixed in 2025.8.1; from 2025.9.0, fixed in 2025.9.1; from 1.0.0, fixed in 2025.7.2; from 1.0.0, fixed in 2025.7.3; from 2025.8.0, fixed in 2025.8.2; from 2025.9.0, fixed in 2025.9.2. ### [CVE-2024-8113](https://cve.now/CVE-2024-8113): Stored XSS in Placeholder Samples in Mail Preview - Severity: High 7.2 - Published: Aug 23, 2024 - Affected: fixed in 2024.4.1; fixed in 2024.7.1. ### [CVE-2024-27447](https://cve.now/CVE-2024-27447): pretix before 2024.1.1 mishandles file validation. - Severity: Critical 9.8 - Published: Feb 26, 2024 - Affected: fixed in 2024.1.1. ### [CVE-2023-44463](https://cve.now/CVE-2023-44463): An issue was discovered in pretix before 2023.7.1. - Severity: Medium 5.3 - Published: Oct 2, 2023 - Affected: fixed in 2023.7.1; fixed in 2023.7.1. ### [CVE-2023-44464](https://cve.now/CVE-2023-44464): pretix before 2023.7.2 allows Pillow to parse EPS files. - Severity: Unrated - Published: Sep 29, 2023 - Affected: fixed in 2023.7.2. ### [CVE-2023-27891](https://cve.now/CVE-2023-27891): rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. - Severity: Unrated - Published: Mar 6, 2023 - Affected: from 4.17.0, fixed in 4.17.1; from 4.16.0, fixed in 4.16.1; fixed in 4.15.1; fixed in 4.17.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/pretix Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.