Veille CVE

Recherche « pretix »

9 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 7 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « pretix » ✕
  1. CVE-2026-101271 2.1 Faible

    pretix

    OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.

  2. CVE-2026-101270 2.1 Faible

    pretix

    Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

  3. CVE-2026-101269 2.3 Faible

    pretix

    The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

  4. CVE-2026-101268 1.7 Faible

    pretix

    If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

  5. CVE-2026-101267 2.7 Faible

    pretix

    A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

  6. CVE-2026-101266 1.3 Faible

    pretix

    A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.

  7. CVE-2026-82838 6.4 Moyenne

    pretix venueless

    The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

  8. CVE-2026-18029 6.3 Moyenne

    pretix GmbH pretix-girosolution

    Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

  9. CVE-2026-18028 2.3 Faible

    pretix GmbH pretix

    The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.