Information Disclosure Vulnerability in Pretix Email Template System

CVE-2026-2415

What is CVE-2026-2415?

Pretix, an event ticketing software, has a vulnerability that allows potential information disclosure through its email template system. The issue arises from the use of placeholders in emails, which can be manipulated to exfiltrate sensitive data such as database passwords and API keys. Specifically, templates can be crafted to include malicious placeholders, allowing attackers who can control email templates to retrieve system configuration details. Additionally, the evaluation of placeholders in email subjects and bodies multiple times introduces risks, particularly with user-controlled placeholders like {invoice_company}. While the likelihood of exploitation in typical scenarios may be low, it's crucial to take precautions, including rotating all sensitive credentials.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References