# CVE-2026-9712: rami.io pretix authorization bypass in API export endpoint

Source: https://junglewise.ai/threats/cve-2026-9712-rami-io-pretix-authorization-bypass-in-api-export-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-9712 · Severity: medium · CVSS 4 · Published 2026-05-27

pretix is an open-source ticketing and event management platform. A security flaw in its API could allow an authenticated user to download files belonging to other users if they can obtain or guess the unique identifier (UUID) for those files. While the identifiers are long and random, making them difficult to guess, a successful exploit could lead to the unauthorized exposure of exported event data or internal documents.

Technologies: [pretix (PyPI)](https://junglewise.ai/threats/technologies/pypi-pretix), [Rami.Io Pretix](https://junglewise.ai/threats/technologies/pretix). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Rami.Io](https://junglewise.ai/threats/vendors/rami-io).

## Quick answers

**Is CVE-2026-9712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9712 being exploited in the wild.

**How severe is CVE-2026-9712?** Medium severity, with a CVSS score of 4, published 27 May 2026.

**Which products and versions are affected?** pretix (PyPI) ECOSYSTEM:introduced=0,fixed=2026.4.2; Rami.Io Pretix >= 2024.10.0, < 2026.4.2 (excluding 2026.2.2 and 2026.3.2), 2024.10.0 through 2026.4.1.

**Is there a fix for CVE-2026-9712?** Yes. pretix (PyPI): upgrade to 2026.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9712 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-9712?** Check whether you run pretix (PyPI) or Rami.Io Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pretix (PyPI): upgrade to 2026.4.2 or later

  ```sh
  pip install "pretix>=2026.4.2"
  ```


## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in a pretix API endpoint responsible for file downloads. While pretix uses long, random UUIDs to identify export jobs and temporary files, one specific endpoint failed to verify if the requesting user had the appropriate permissions to access the file associated with a given UUID. An attacker with low privileges (authenticated user) could potentially download sensitive exports or internal files if they obtain a valid UUID, for example through log access or other information leaks. The issue is mitigated by the high entropy of the UUIDs, making brute-force attacks impractical. The vulnerability is fixed in versions 2026.4.2, 2026.3.2, and 2026.2.2.

## Affected products

- rami.io pretix >= 2024.10.0, < 2026.4.2 (excluding 2026.2.2 and 2026.3.2)

## Identifiers

- CVE-2026-9712
- GHSA-72p9-6vv6-gvqh
- PYSEC-2026-2960

## Timeline

- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched

## References

- [https://pretix.eu/about/en/blog/20260527-release-2026-4-2](https://pretix.eu/about/en/blog/20260527-release-2026-4-2)

## Related threats

- [PYSEC-2026-1802 - pretix has Broken Access Control Allowing Cross-User File Access via UUID](https://junglewise.ai/threats/cve-2025-14882-pretix-has-broken-access-control-allowing-cross-user-file-access)
- [PYSEC-2026-1801 - pretix allows Pillow to parse EPS files](https://junglewise.ai/threats/cve-2023-44464-pretix-allows-pillow-to-parse-eps-files)
- [rami.io pretix privilege escalation via session parameter injection](https://junglewise.ai/threats/cve-2026-13602-rami-io-pretix-privilege-escalation-via-session-parameter)
- [rami.io pretix reflected XSS in redirection page](https://junglewise.ai/threats/cve-2026-57533-rami-io-pretix-reflected-xss-in-redirection-page)
- [rami.io pretix stored XSS in ticket confirmation page](https://junglewise.ai/threats/cve-2026-13225-rami-io-pretix-stored-xss-in-ticket-confirmation-page)