Executive brief
pretix, an event ticketing and management platform, contains a security flaw in its event setup process. A user with limited access to an organization could bypass security checks to modify critical event settings, such as payment configurations and product details, for events they should not be able to edit. This could allow unauthorized users to redirect payments or alter event offerings, though the risk is limited to events that have not yet been fully configured.
Technical details
An authorization bypass vulnerability exists in pretix's 'quick setup' view due to a failure to properly verify user permissions for a specific event. The flaw, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), allows an authenticated attacker with limited (e.g., read-only) access to an organizer's account to perform administrative actions. By sending a crafted request to the quick setup endpoint, an attacker can create products, set quotas, configure bank transfers, or link a Stripe account to an unconfigured event. The vulnerability is mitigated by the fact that it is primarily exploitable on newly created, unconfigured events and requires the attacker to already have some level of access to the organizer account. The issue is fixed in versions 2026.6.1, 2026.5.4, and 2026.4.6.
Affected products
- pretix GmbH pretix < 2026.4.6, 2026.5.0 to < 2026.5.4, 2026.6.0 to < 2026.6.1
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched
- 2026-07-28: advisory