API Vulnerability in Pretix Event Management Software by Pretix

CVE-2026-5600

What is CVE-2026-5600?

A flaw in the newly introduced API endpoint of Pretix allows unauthorized access to check-in event data across multiple events under the same organizer. The endpoint, intended to provide details for specific events, inadvertently returns information on all events managed by the same organizer. This can lead to unauthorized exposure of sensitive data, including ticket scan results, timestamps, and ticket IDs. Thus, an API consumer can potentially access information that should remain confidential, posing significant risks to user privacy.

References