Security release 2026.8.1 of pretix
We have become aware of security issues in pretix due to external reports and internal discoveries.
We therefore just released versions 2026.8.1, 2026.7.3, and 2026.6.4 of pretix that fix these problems. It is strongly recommended that you update your installation as soon as possible.
If you are a customer of our pretix Hosted service, the vulnerabilities are already fixed for you and you do not need to take action.
#1: Giftcard enumeration [MEDIUM]
CVE ID: CVE-2026-101273
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
We have verified that this issue has not been exploited by anyone on pretix Hosted.
Severity rating: This is a severe violation of the boundary between organizers in pretix. However, since any abuse would likely quickly raise alarm flags, is easily traceable, and requires an authenticated account on the system (which is a barrier for most self-hosted installations) we assess the severity to be medium.
Affected versions: All currently supported versions (except the fixed versions listed below) are affected.
This issue has been discovered by Romel Lanza.
#2: Improper validation of OpenID Connect properties for customer account SSO [MEDIUM]
CVE ID: CVE-2026-101274
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the response_type requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the code response type, which requires knowledge of the client secret to use and would wrongfully send a response type like id_token, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by redirect_uri, which must be from a list specified in the client configuration.
Severity rating: This is a flaw in the authentication layer for customer accounts. However, it is only exploitable if there is also a vulnerability on the third-party site embedding the SSO authentication and it can only be used to exfiltrate name, email address and phone number of the user, not any order data. Therefore, we assess the severity to be medium.
Affected versions: All currently supported versions (except the fixed versions listed below) are affected.
This issue has been discovered by Ravi Gohel.
#3: Incorrect session validation for API-created shredder exports [LOW]
CVE ID: CVE-2026-101272
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.
Severity rating: Since the attack requires knowledge of a UUID, which is not guessable, we assess the severity to be low.
Affected versions: All currently supported versions (except the fixed versions listed below) are affected.
This issue has been discovered by Sahil Kushwaha.
Fixed versions
We just released updates for the last three stable versions on PyPI that fix the problem. If you run a pretix installation older than 2026.5, please upgrade to a recent version now.
The new docker images will appear on Docker Hub over the next few hours.
We strongly recommend that you always run the latest version of pretix, as every release contains useful and important bug fixes, even if they are not security related.
If you want to keep updated about bugfix and security releases, you should follow this blog closely. A RSS feed is available and we also announce every blogpost on Mastodon.
We take the security of our product very seriously and always go the extra mile to make sure you stay safe. As we are humans, security issues unfortunately still might occur from time to time. We do everything we can to find and fix them as timely as we can. If you notice any security problems or have any questions on this topic, please contact us in private at security@pretix.eu. We will always treat your message with the appropriate priority.
