Pretix vulnerabilities
40 CVEs and advisories name Pretix as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-125744Missing permission check in ticket layout API
- CVE-2026-101275Insufficient validation of payment status in pretix-adyen
- CVE-2026-101272Incorrect session validation for API-created shredder exports
- CVE-2026-101274When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate…
- CVE-2026-101273Giftcard enumeration
- CVE-2026-101271OAuth credentials not disabled when application is disabled
- CVE-2026-101270HTML injection
- CVE-2026-101269Incorrect session validation for API-uploaded files
- CVE-2026-101268Customer session fixation
- CVE-2026-101267Revenue information leak
- CVE-2026-101266Checkout validation bypass
- CVE-2026-82838Default webserver configuration with incorrect CSP
- CVE-2026-18028Missing authorization check in event quick setup view
- CVE-2026-18029Insufficient validation of payment status in pretix-girosolution
- CVE-2026-13602Session takeover vulnerability
- CVE-2026-13603SSRF with API key leak in pretix-oppwa
- CVE-2026-13350Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
- CVE-2026-57532Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in
- CVE-2026-57533Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.
- CVE-2026-57535Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.
- CVE-2026-13225Stored XSS in ticket confirmation page
- CVE-2026-57534Stored XSS in pretix-pages
- CVE-2026-57536Insufficient validation of payment status in pretix-mollie
- CVE-2026-13222Insufficient validation of payment status in pretix-oppwa
- CVE-2026-13223Insufficient validation of payment status in pretix-computop
- CVE-2026-13314Stored XSS in pretix-digital
- CVE-2026-12863Open redirect
- CVE-2026-12862XLSX formula injection in exports
- CVE-2026-11764Data exposed without proper permission
- CVE-2026-9712Insecure direct object reference