Security release 2026.9.1 of pretix and pretix-adyen plugin
We have become aware of security issues in pretix due to external reports.
We therefore just released versions 2026.9.1, 2026.8.2, and 2026.7.4 of pretix as well as version 1.5.4 of pretix-adyen that fix these problems. It is strongly recommended that you update your installation as soon as possible.
If you are a customer of our pretix Hosted service, the vulnerabilities are already fixed for you and you do not need to take action.
Insufficient validation of payment status in pretix-adyen [MEDIUM]
CVE ID: CVE-2026-101275
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Severity rating: Since no data exposure is at risk and large-scale exploitation is likely to be noticed, we assess the severity as medium.
Affected versions: All currently supported versions (except the fixed versions listed below) are affected.
This issue has been reported to us by Digant Prajapati.
Missing permission check in ticket layout API [LOW]
CVE ID: CVE-2026-125744
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
Severity rating: Since this is only exploitable by users with access to the event and ticket layouts are not really sensitive or allow further data extraction, we assess the severity as low.
Affected versions: All currently supported versions (except the fixed versions listed below) are affected.
This issue has been reported to us by Immanuel Tikhonov.
Fixed versions
We just released updates for the last three stable versions on PyPI that fix the problem. If you run a pretix installation older than 2026.7, please upgrade to a recent version now.
We have also published a fixed plugin version:
We strongly recommend that you always run the latest version of pretix, as every release contains useful and important bug fixes, even if they are not security related.
If you want to keep updated about bugfix and security releases, you should follow this blog closely. A RSS feed is available and we also announce every blogpost on Mastodon.
We take the security of our product very seriously and always go the extra mile to make sure you stay safe. As we are humans, security issues unfortunately still might occur from time to time. We do everything we can to find and fix them as timely as we can. If you notice any security problems or have any questions on this topic, please contact us in private at security@pretix.eu. We will always treat your message with the appropriate priority.
