Executive brief
A vulnerability in the pretix ticketing system allows an attacker with limited access to take over any other user account, including administrator accounts. By exploiting a chain of weaknesses in how the system signs and validates web sessions, an attacker can impersonate other users and gain full access to sensitive event data and financial settings. This could lead to a total compromise of the ticketing platform's operations and customer data.
Technical details
This vulnerability is a chain of three distinct weaknesses. First, multiple payment plugins (e.g., Stripe, Mollie) transport session parameters via signed URL parameters without validating the scope of those parameters. Second, the core system's Referer-obfuscating redirect feature uses the same cryptographic key and salt as the payment plugins, allowing an attacker with event access to generate validly signed arbitrary content. Third, the administrative 'impersonate' feature relied on session parameters that could be guessed (user IDs). By combining these, an attacker can inject a signed 'impersonate' parameter into their session to become any user. The fix introduces strict parameter validation, unique salts for different features, and unguessable session tokens for impersonation.
Affected products
- rami.io pretix 4.14.0 through 2026.3.4, 2026.4.0 through 2026.4.4, 2026.5.0 through 2026.5.2
- rami.io pretix-mollie < 2.5.7
- rami.io pretix-oppwa < 1.4.4
- rami.io pretix-bitpay < 1.5.3
- rami.io pretix-payone < 1.4.3
- rami.io pretix-secuconnect < 1.0.4
- rami.io pretix-sofort < 1.4.2
- rami.io pretix-saferpay < 1.6.3
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: Fixed in pretix 2026.5.3, 2026.4.5, and 2026.3.5.post1