EUVD-2026-40995
GHSA-q93m-6jvc-jc45
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and low-complexity but requires an existing backend event account (PR:L); becoming any user crosses a privilege boundary (S:C) with full C/I/A compromise.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
2DescriptionCVE.org
We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data:
*
The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, and pretix-saferpay contain a code path that is intended for the transport of session parameters from a tab with isolated cookies (e.g. in the pretix widget) to a new tab. For this purpose, a set of session parameters is cryptographically signed and then passed to the new tab as a URL parameter. The plugins perform no further validation of the session parameters, other than the cryptographic signature being valid. This is fixed with the releases issued today by strictly validating that no session parameters outside of the scope of the respective plugin may be set.
*
An unrelated feature in the core system is used to generate redirect links that obfuscate any Referer headers for outgoing links to prevent leakage of secrets in URLs. This redirect page also requires cryptographically signed parameters. Unfortunately, it uses the same key and salt for the signature as the previously mentioned feature in the payment integration plugins. A motivated attacker with access to at least one event in the backend can trick the system into cryptographically signing arbitrary content using specially crafted links. In combination with the previous issue, the attacker could use this to set and modify arbitrary parameters on their user session by injecting the signed parameters into the feature of the payment providers. This is fixed with the releases issued today by using different salts for the signature for each plugin and feature.
*
A third, unrelated feature in the core system is used for admin users to act on behalf of another user, mostly for debugging purposes. With being able to insert arbitrary parameters into a session, an attacker can abuse this feature to change their session from their actual user to any user in the system by guessing a valid user ID. This is fixed with the release today by requiring unguessable information to be contained in the session of the user to switch to.
AnalysisAI
Privilege escalation to full account takeover in pretix (open-source event ticketing) and its payment integration plugins (Stripe, pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, pretix-saferpay) lets an authenticated backend operator become any user and read any data in the system. The flaw chains three weaknesses: a signed-session-parameter transport path with no scope validation, a signing-oracle reuse of the same key/salt in an unrelated Referer-obfuscation redirect, and the admin "act on behalf of" impersonation feature. No public exploit is identified at time of analysis (CVSS 4.0 carries E:U, exploit unproven), but the vendor fixed all affected components in releases published 2026-07-01.
Technical ContextAI
pretix is a Django-based, self-hostable and SaaS event ticketing platform; the affected surface spans the core system and eight payment-provider plugins listed in the CPE set (cpe:2.3:a:pretix:pretix and the pretix-mollie/oppwa/bitpay/payone/secuconnect/sofort/saferpay plugins, with Stripe bundled in core). The root cause maps to CWE-20 (Improper Input Validation): a code path meant to carry session parameters from a cookie-isolated tab (e.g. the embeddable pretix widget) to a new tab passes a cryptographically signed parameter blob but validates only the signature - never that the parameters fall within the plugin's legitimate scope. Cryptographic signing here is used as an integrity/authenticity gate, but because a separate core feature (redirect links that strip Referer headers to avoid leaking URL secrets) reused the identical signing key AND salt, that redirect endpoint becomes a signing oracle that will sign attacker-chosen content. Django's signing framework separates trust domains by salt, so sharing a salt across two features collapses them into one forgeable trust domain.
RemediationAI
Patch available per vendor advisory: upgrade the pretix core to the release issued 2026-07-01 (release 2026.5.3, https://pretix.eu/about/en/blog/20260701-release-2026-5-3/) and simultaneously update every installed affected payment plugin (pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, pretix-saferpay) to their same-day fixed releases, since core and plugins were patched in a coordinated set and a partial upgrade leaves the chain intact. The fixes strictly validate that no session parameters outside a plugin's own scope may be set, assign distinct signature salts per plugin and feature to remove the signing-oracle reuse, and require unguessable session information before the admin impersonation feature will switch users. If immediate patching is impossible, the strongest compensating control is to tightly restrict who holds backend event access, since exploitation requires an authenticated organizer account (PR:L) - audit and remove untrusted or dormant staff/organizer accounts on shared instances; on multi-tenant SaaS deployments this is especially urgent because any low-privilege tenant is a potential attacker. Exact per-plugin fixed version strings should be confirmed directly from the advisory before deployment.
pretix before 2024.1.1 mishandles file validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript
pretix before 2023.7.2 allows Pillow to parse EPS files. Rated high severity (CVSS 7.8), this vulnerability is no authen
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. Rated high severity (CVSS
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tag
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Pretix email template placeholder injection enables authenticated backend users to extract sensitive system information
Pretix 2025 and 2026 versions contain an API endpoint authorization bypass that returns all check-in events for an organ
HTML injection on pretix's individual ticket confirmation page allows unsanitized email address content to execute arbit
An issue was discovered in pretix before 2023.7.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely expl
Gift card secret exposure in pretix event ticketing software allows a highly privileged user who lacks explicit gift car
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today