# cve.now: Pretix

The newest entries naming Pretix as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-125744](https://cve.now/CVE-2026-125744.md): Missing permission check in ticket layout API (CVSS 1.2)
- [CVE-2026-101275](https://cve.now/CVE-2026-101275.md): Insufficient validation of payment status in pretix-adyen (CVSS 6.3)
- [CVE-2026-101272](https://cve.now/CVE-2026-101272.md): Incorrect session validation for API-created shredder exports (CVSS 2.3)
- [CVE-2026-101274](https://cve.now/CVE-2026-101274.md): When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate… (CVSS 6.9)
- [CVE-2026-101273](https://cve.now/CVE-2026-101273.md): Giftcard enumeration (CVSS 5.3)
- [CVE-2026-101271](https://cve.now/CVE-2026-101271.md): OAuth credentials not disabled when application is disabled (CVSS 2.1)
- [CVE-2026-101270](https://cve.now/CVE-2026-101270.md): HTML injection (CVSS 2.1)
- [CVE-2026-101269](https://cve.now/CVE-2026-101269.md): Incorrect session validation for API-uploaded files (CVSS 2.3)
- [CVE-2026-101268](https://cve.now/CVE-2026-101268.md): Customer session fixation (CVSS 1.7)
- [CVE-2026-101267](https://cve.now/CVE-2026-101267.md): Revenue information leak (CVSS 2.7)
- [CVE-2026-101266](https://cve.now/CVE-2026-101266.md): Checkout validation bypass (CVSS 1.3)
- [CVE-2026-82838](https://cve.now/CVE-2026-82838.md): Default webserver configuration with incorrect CSP (CVSS 6.4)
- [CVE-2026-18028](https://cve.now/CVE-2026-18028.md): Missing authorization check in event quick setup view (CVSS 2.3)
- [CVE-2026-18029](https://cve.now/CVE-2026-18029.md): Insufficient validation of payment status in pretix-girosolution (CVSS 6.3)
- [CVE-2026-13602](https://cve.now/CVE-2026-13602.md): Session takeover vulnerability (CVSS 7.7)
- [CVE-2026-13603](https://cve.now/CVE-2026-13603.md): SSRF with API key leak in pretix-oppwa (CVSS 9.0)
- [CVE-2026-13350](https://cve.now/CVE-2026-13350.md): Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. (CVSS 2.3)
- [CVE-2026-57532](https://cve.now/CVE-2026-57532.md): Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in (CVSS 8.8)
- [CVE-2026-57533](https://cve.now/CVE-2026-57533.md): Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. (CVSS 2.1)
- [CVE-2026-57535](https://cve.now/CVE-2026-57535.md): Content injected to PDF rendering contexts could, in many places, include HTML content including \<img\> tags. (CVSS 2.1)
- [CVE-2026-13225](https://cve.now/CVE-2026-13225.md): Stored XSS in ticket confirmation page (CVSS 5.3)
- [CVE-2026-57534](https://cve.now/CVE-2026-57534.md): Stored XSS in pretix-pages (CVSS 2.1)
- [CVE-2026-57536](https://cve.now/CVE-2026-57536.md): Insufficient validation of payment status in pretix-mollie (CVSS 6.3)
- [CVE-2026-13222](https://cve.now/CVE-2026-13222.md): Insufficient validation of payment status in pretix-oppwa (CVSS 6.3)
- [CVE-2026-13223](https://cve.now/CVE-2026-13223.md): Insufficient validation of payment status in pretix-computop (CVSS 6.3)
- [CVE-2026-13314](https://cve.now/CVE-2026-13314.md): Stored XSS in pretix-digital (CVSS 2.0)
- [CVE-2026-12863](https://cve.now/CVE-2026-12863.md): Open redirect (CVSS 5.1)
- [CVE-2026-12862](https://cve.now/CVE-2026-12862.md): XLSX formula injection in exports (CVSS 5.1)
- [CVE-2026-11764](https://cve.now/CVE-2026-11764.md): Data exposed without proper permission (CVSS 3.6)
- [CVE-2026-9712](https://cve.now/CVE-2026-9712.md): Insecure direct object reference (CVSS 3.8)
- [CVE-2026-5600](https://cve.now/CVE-2026-5600.md): A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check- (CVSS 5.5)
- [CVE-2026-5599](https://cve.now/CVE-2026-5599.md): API allows deletion of users of other instance (CVSS 7.3)
- [CVE-2026-4982](https://cve.now/CVE-2026-4982.md): Unauthorized access to chat contents (CVSS 7.3)
- [CVE-2026-2452](https://cve.now/CVE-2026-2452.md): Unsafe variable evaluation in email templates (CVSS 7.5)
- [CVE-2026-2451](https://cve.now/CVE-2026-2451.md): Unsafe variable evaluation in email templates (CVSS 7.5)
- [CVE-2026-2415](https://cve.now/CVE-2026-2415.md): Unsafe variable evaluation in email templates (CVSS 7.5)
- [CVE-2025-14881](https://cve.now/CVE-2025-14881.md): Insecure direct object reference (CVSS 3.8)
- [CVE-2025-14882](https://cve.now/CVE-2025-14882.md): Insecure direct object reference (CVSS 3.8)
- [CVE-2025-13742](https://cve.now/CVE-2025-13742.md): Limited HTML injection in emails (CVSS 2.4)
- [CVE-2024-8113](https://cve.now/CVE-2024-8113.md): Stored XSS in Placeholder Samples in Mail Preview (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pretix
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.