pretix has 13 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 9 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 2.3 (low). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 2.3
- Publish → KEV
- —
- Last 90 days
- 9 prev 1
Worst active — by depth score
CVE-2023-44464High· 7.8pretix allows Pillow to parse EPS files43CVE-2026-101274Medium· 6.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…38CVE-2026-101273Medium· 5.3Giftcard enumeration29CVE-2026-101267Low· 2.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information15CVE-2026-9712Lowpretix vulnerable to Authorization Bypass Through User-Controlled Key14
pretix vulnerabilities
CVEs affecting pretix, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-101273Medium· 5.3Giftcard enumeration
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and t…
CVE-2026-101274Medium· 6.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…
CVE-2026-101272Low· 2.3Incorrect session validation for API-created shredder exports
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but wa…
CVE-2026-101268Low· 1.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacke…
CVE-2026-101267Low· 2.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
CVE-2026-101270Low· 2.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
CVE-2026-101269Low· 2.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUI…
CVE-2026-101271Low· 2.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
CVE-2026-101266Low· 1.3A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
CVE-2026-9712Lowpretix vulnerable to Authorization Bypass Through User-Controlled Key
pretix vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2025-14881LowMultiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
CVE-2025-14882Lowpretix has Broken Access Control Allowing Cross-User File Access via UUID
pretix has Broken Access Control Allowing Cross-User File Access via UUID
CVE-2023-44464High· 7.8pretix allows Pillow to parse EPS files
pretix allows Pillow to parse EPS files