EUVD-2026-88746
GHSA-v4x7-7x4h-rmj8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as checkout user
-
DeliveryBegin event checkout flow
-
ExploitSkip required check-in step(s)
-
ExecutionBypass step validations
-
ImpactComplete checkout in invalid state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Requires an authenticated user (PR:L) actively using pretix's event checkout flow; exploitation consists of skipping entire check-in steps to evade the validations those steps perform. Limiting factors: the actor must be a legitimate participant in the checkout process (not an unauthenticated remote attacker), impact is confined to integrity of the check-in/checkout data with no availability effect, and only deployments running affected pretix versions prior to the 2026.7.1 fix are exposed. No user interaction from a victim is needed (UI:N). |
| Impact | This is a low-priority, low-real-risk business-logic flaw despite the 'Authentication Bypass' tag. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) scores only 1.3, driven by low impacts and E:U (Exploit code Unproven). Signals are consistent and point away from urgency: no KEV listing, no EPSS score provided, and no public exploit - status is 'no public exploit identified at time of analysis.' The vector requires PR:L, so this is exploitable only by an authenticated actor (a legitimate user/attendee of the checkout flow), not an anonymous internet attacker, which contradicts the 'Authentication Bypass' framing - this is a validation-skipping logic flaw (CWE-20), not a login/auth-control bypass. Impact is integrity-oriented (process validations are skipped), with no availability impact. There are no conflicting attack-vector signals: CVSS says network-reachable and the description (a web checkout flow) agrees. Overall this is a genuinely minor issue, correctly rated low by the vendor, not a high-CVSS-but-low-risk mismatch. |
| Exploit ScenarioDerived | An authenticated user progressing through a pretix event checkout manipulates the flow to skip mandatory check-in steps, bypassing the validations those steps enforce (e.g., required data or eligibility checks) and completing checkout in an invalid state. No public exploit code exists, and CVSS AC:L/PR:L indicates the manipulation is straightforward for any legitimate user but not available to unauthenticated outsiders. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Authenticated users of the pretix ticketing platform can bypass validation logic built into the checkout flow by skipping entire check-in steps, allowing data that those steps were meant to verify to pass through unchecked. The flaw requires a legitimate participant in the checkout process (PR:L) and only affects the integrity of check-in/checkout data - there is no confidentiality or availability impact and no victim interaction is required. Only deployments running pretix versions prior to the 2026.7.1 release are exposed, and no public exploit identified at time of analysis; the vendor's own scoring is low (CVSS 1.3), matching an independent assessment of low real-world risk despite the 'Authentication Bypass' tag.
RemediationAI
Upgrade pretix to the 2026.7.1 release (documented in the vendor's 2026-7-1 release announcement at https://pretix.eu/about/en/blog/20260929-release-2026-7-1/); this is the vendor-released patch and the only complete fix, since the defect is in flow orchestration and cannot be reliably corrected by configuration. If immediate upgrade is not possible, compensating controls are limited and carry trade-offs: restrict who can reach the checkout/check-in endpoints (for example by requiring the relevant event roles or placing the pretix instance behind network allow-listing or a reverse-proxy authentication layer), which reduces the pool of authenticated accounts that can trigger the skip but can disrupt legitimate attendee self-service and on-site check-in; and enable and monitor pretix's order and check-in audit logs for out-of-sequence or missing check-in events so that any data integrity drift from bypassed validations can be detected and corrected manually, at the cost of ongoing administrative review. Note that no vendor-released alternative patch exists for versions below 2026.7.1, and downgrading or partially disabling the checkout flow will break ticket sales, so upgrading remains the recommended path. Given the low assessed impact (integrity-only, authenticated participant, no availability effect) this should be scheduled as routine maintenance rather than emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pretix is an open-source ticket sales and event management platform whose checkout and check-in flows are implemented as a sequence of discrete server-side steps (order placement, payment/validation, admission and check-in). CVE-2026-101266 is a business-logic defect classified under CWE-20 (Improper Input Validation): the application trusts client-driven navigation through the checkout state machine, so a request can advance directly past intermediate steps instead of being forced through the validations those steps perform. Because the weakness is in the sequencing/trust of the flow rather than in a memory-safety or injection primitive, the practical effect is confined to integrity of check-in and checkout records. The CPE string cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* uses a wildcard version, indicating the advisory maps the issue to the pretix product family generally rather than to a single enumerated build, with the 2026.7.1 release serving as the version boundary. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the attack is reachable over the network, needs no special preconditions, and requires a low-privileged authenticated session, while the threat metrics (E:U) indicate no known exploitation activity.
Know when Pretix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U
Network-reachable web checkout (AV:N/AC:L), exploitable only by an authenticated user (PR:L); impact is limited to integrity of the check-in process (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
1DescriptionCVE.org
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
pretix before 2024.1.1 mishandles file validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
Server-side URL manipulation in the pretix-oppwa payment plugin (fixed in pretix 2026.5.3) lets a remote attacker exfilt
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript
pretix before 2023.7.2 allows Pillow to parse EPS files. Rated high severity (CVSS 7.8), this vulnerability is no authen
Privilege escalation to full account takeover in pretix (open-source event ticketing) and its payment integration plugin
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. Rated high severity (CVSS
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tag
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusin
Exploit-DB