pretix up to 2026.1.1/2026.2.0/2026.3.0 API Endpoint improper isolation or compartmentalization

Summaryinfo

A vulnerability has been found in pretix up to 2026.1.1/2026.2.0/2026.3.0 and classified as problematic. The affected element is an unknown function of the component API Endpoint. The manipulation leads to improper isolation or compartmentalization. This vulnerability is traded as CVE-2026-5600. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in pretix up to 2026.1.1/2026.2.0/2026.3.0. It has been rated as problematic. This issue affects an unknown part of the component API Endpoint. The manipulation with an unknown input leads to a improper isolation or compartmentalization vulnerability. Using CWE to declare the problem leads to CWE-653. The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions. Impacted is confidentiality. The summary by CVE is:

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" } An unauthorized user usually has no way to match these IDs (position) back to individual people.

The weakness was shared by Pratik Karan. It is possible to read the advisory at pretix.eu. The identification of this vulnerability is CVE-2026-5600 since 04/05/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2026.1.2, 2026.2.1 or 2026.3.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• pretix

Version

• 2026.0
• 2026.1
• 2026.1.0
• 2026.1.1
• 2026.2
• 2026.2.0
• 2026.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion