Vulnerabilities in pretix
36 resultsCVE-2026-2415HIGHUnsafe variable evaluation in email templatesEPSS 0.3%CVE-2026-13350LOWPermissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.EPSS 0.3%CVE-2026-101266LOWCheckout validation bypassEPSS 0.3%CVE-2026-5600MEDIUMA new API endpoint introduced in pretix 2025 that is supposed to
return all check-in events of a specific event in fact returns all
check-EPSS 0.3%CVE-2025-14882LOWInsecure direct object referenceEPSS 0.2%CVE-2025-14881LOWInsecure direct object referenceEPSS 0.2%CVE-2026-101267LOWRevenue information leakEPSS 0.2%CVE-2026-5599HIGHAPI allows deletion of users of other instanceEPSS 0.2%CVE-2026-4982HIGHUnauthorized access to chat contentsEPSS 0.2%CVE-2026-11764LOWData exposed without proper permissionEPSS 0.2%CVE-2026-101269LOWIncorrect session validation for API-uploaded filesEPSS 0.2%CVE-2026-9712LOWInsecure direct object referenceEPSS 0.2%CVE-2026-101268LOWCustomer session fixationEPSS 0.2%CVE-2025-13742LOWLimited HTML injection in emailsEPSS 0.2%CVE-2026-101270LOWHTML injectionEPSS 0.2%CVE-2026-101271LOWOAuth credentials not disabled when application is disabledEPSS 0.2%