Executive brief
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
Affected products
- PyPI pretix
Junglewise Threat Intelligence
CVE-2023-27891: PYSEC-2023-42 - rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.
CVE-2023-27891 · Severity: low · CVSS 3.1 · Published 2023-03-06
Technologies: pretix (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1803 - pretix has Broken Access Control Allowing Cross-User File Access via UUID
- PYSEC-2026-1802 - pretix has Broken Access Control Allowing Cross-User File Access via UUID
- PYSEC-2026-1801 - pretix allows Pillow to parse EPS files
- rami.io pretix authorization bypass in API export endpoint
- rami.io pretix data isolation breach in check-in API