pretix CVE-2026-101270

Requires an authenticated account holding organizer permissions in pretix - the attacker must be able to edit the help texts of fields exposed through the organizer configuration UI. Exploitation further depends on a victim subsequently viewing a page that renders the injected help text (UI:P), and the vendor rates the attack as high-complexity with an additional attack requirement (AC:H/AT:P), meaning it is not reliably repeatable against arbitrary targets. Limiting factors: the organizer privilege gate, required victim interaction, and non-trivial preconditions sharply narrow realistic exploitation beyond a malicious or compromised organizer account.

This is a low-real-risk issue despite being a stored injection flaw. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:P) yields only 2.1, and every signal reinforces low priority: exploitation requires an authenticated actor who already holds organizer permissions (PR:L), high attack complexity plus a specific attack requirement (AC:H/AT:P), and victim interaction (UI:P). Impact is limited to low confidentiality and integrity in both the vulnerable and a subsequent system (VC:L/VI:L/SC:L/SI:L), with no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced - consistent with 'no public exploit identified at time of analysis.' The core caveat is trust model: an organizer is a semi-privileged, often self-service role in a multi-tenant ticketing deployment, so the flaw is essentially a privileged user injecting HTML that renders in other users' browsers (stored XSS-style), which is why the CVSS shows a scope/subsequent-system change. This is a real but low-severity finding, not a widespread-exploitation priority.

An attacker who has (or registers for) an organizer account in a pretix instance edits the help text of a form field and embeds malicious HTML/JavaScript. When another user - for example an attendee filling out the order form or an admin reviewing the event - renders the affected page, the injected markup executes in their browser session, enabling limited content spoofing or script execution. No public proof-of-concept is referenced, and the attack is limited by the need for organizer privileges, victim interaction, and high complexity.