CVE-2026-5600 Details
Description
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" } An unauthorized user usually has no way to match these IDs (position) back to individual people.
A vulnerability in the Pretix API introduced in version 2025 allows unauthorized access to check-in events across all events of the same organizer. Instead of limiting the data to a specific event, the endpoint exposes check-in information for all events under the organizer's account, including details such as ticket scan times, results, and ticket IDs. This issue could lead to unauthorized data access, especially for organizers hosting third-party events.
Users are advised to update to Pretix versions 2026.3.1, 2026.2.1, or 2026.1.2, all of which include the necessary fix. For those using the Pretix Hosted service, the vulnerability has already been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://pretix.eu/about/en/blog/20260408-release-2026-3-1/ | rami.io | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-653 | Improper Isolation or Compartmentalization | rami.io |
Affected Products
| Product | Versions |
|---|---|
| pretix pretix | >= 2025.10.0, < 2026.1.2 >= 2026.2.0, < 2026.2.1 >= 2026.3.0, < 2026.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | rami.io |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 8, 2026 | New CVE Received | rami.io |