EUVD-2026-88748
GHSA-3pqp-5pr2-r88m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged event team member
-
ExploitRequest order-summary data lacking permission check
-
ExecutionServer returns attendee count and total revenue
-
ImpactObtain confidential business metrics
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated pretix account that has been granted access to a specific event but deliberately NOT granted access to that event's orders - the classic under-privileged team-member role in pretix's per-event permission model. The attacker must already be a legitimate low-privileged user within the organizer's team; there is no path for a fully unauthenticated outsider despite the vendor vector's PR:N. Exploitation leaks only two aggregate values (attendee count, total revenue), which sharply limits impact. Affected versions are pretix before 2026.7.1; upgrading to 2026.7.1 remediates. |
| Impact | This is a genuinely low-risk, low-priority issue despite being remotely reachable. The vendor CVSS 4.0 score is 2.7 with an E:U (unreported/unproven exploit) status, and there is no EPSS score, no CISA KEV listing, and no public POC - so all exploitation-probability signals point to 'no known exploitation.' The described impact is purely a confidentiality leak of two aggregate business metrics (attendee count and total revenue), not credentials, PII, or system control. SIGNAL CONFLICT: the vendor's CVSS 4.0 vector states PR:N (unauthenticated), but the description explicitly says the flaw affects 'low-privileged users with access to an event' - i.e. it requires an authenticated organizer/team account. The vector therefore understates privilege requirements; PR:L is the accurate reading and PR:N should not be trusted. Additionally the vendor vector claims VI:L/SI:L (integrity impact), but the described behavior is read-only extraction of information - no data is modified - so the integrity metrics appear overstated. Net: a real but minor broken-access-control bug, not a high-urgency vulnerability. |
| Exploit ScenarioDerived | A low-privileged pretix team member who has been granted access to an event, but explicitly NOT to that event's orders, queries an endpoint that fails to enforce the order-level permission check and reads back the event's total attendee count and total revenue. No public exploit code exists, and the leaked data is limited to two aggregate business figures rather than individual attendee records or payment data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Low-privileged pretix team members who can reach a specific event but who were deliberately denied access to that event's orders can read two aggregated business figures they should not see: the event's attendee count and its total revenue. Exploitation requires an authenticated account already placed on the organizer's team with event-level access but without order-level permission, so there is no path for an outside, unauthenticated attacker, and the disclosure is confined to aggregate numbers rather than individual order or personal data. No public exploit code has been identified at time of analysis, and the issue is assessed as a genuinely low-risk, low-priority information-disclosure bug affecting pretix installations before 2026.7.1.
RemediationAI
Upgrade pretix to version 2026.7.1, the vendor-released patch that adds the missing order-permission check and closes the leak; the release announcement at https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ is the authoritative reference and confirms 2026.7.1 is the first fixed version. Where an immediate upgrade is not possible, the practical compensating control is administrative rather than technical: audit the organizer's team assignments and avoid granting event-level access to any account that is not also trusted with order-level data, since the whole exposure depends on the existence of such under-privileged team members - the trade-off is reduced operational flexibility for staff who only need scheduling or logistics views, and it does not remove the flawed code path. Restricting network reachability to the pretix web interface, for example limiting it to internal networks or behind a VPN, reduces the remote attack surface but is heavy-handed for a hosted or publicly exposed ticket shop and would break normal attendee-facing storefront functionality, so it should be treated as a stopgap at most. Because only aggregate attendee counts and revenue totals are disclosed, and no public exploit code exists, remediation can reasonably follow the normal release cycle rather than an emergency one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pretix is an open-source event ticketing and registration platform, and this flaw lives in its per-event permission model, where separate grants control whether a team member can see an event at all versus whether they can view its orders. The vulnerable code path performs an access check that confirms event-level visibility but omits the corresponding check on the orders permission, so a request from an under-privileged team member succeeds and returns derived statistics - attendee count and total revenue - that are normally computed from order data. Although no CWE was assigned in the supplied data, this is the classic missing-authorization pattern (CWE-862 improper/missing authorization check, in the broader CWE-284 access-control family): the resource is served without re-validating the caller's entitlement to the underlying orders. Note the divergence between the vendor-supplied CVSS 4.0 vector, which lists PR:N, and the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), which correctly reflects that a valid authenticated session with a deliberately restricted role is a prerequisite; the independent assessment is authoritative here.
Know when Pretix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U
Network-reachable web app (AV:N/AC:L) but needs an authenticated low-privileged event account (PR:L); read-only leak of aggregate data means C:L with no integrity or availability impact.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
1DescriptionCVE.org
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
pretix before 2024.1.1 mishandles file validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
Server-side URL manipulation in the pretix-oppwa payment plugin (fixed in pretix 2026.5.3) lets a remote attacker exfilt
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript
pretix before 2023.7.2 allows Pillow to parse EPS files. Rated high severity (CVSS 7.8), this vulnerability is no authen
Privilege escalation to full account takeover in pretix (open-source event ticketing) and its payment integration plugin
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. Rated high severity (CVSS
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tag
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusin
Exploit-DB