Is there a patch available for CVE-2026-5600?

Yes, a patch is available for CVE-2026-5600. Update the affected software to the latest version immediately.

Pretix CVE-2026-5600

Q: What is the CVSS score of CVE-2026-5600?

CVE-2026-5600 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-20463 MEDIUM

Improper Isolation or Compartmentalization (CWE-653)

2026-04-08 rami.io

GHSA-wr8q-c73g-m7gp

Authentication Bypass Pretix

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 09, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 13:16 euvd

EUVD-2026-20463

Analysis Generated

Apr 08, 2026 - 13:16 vuln.today

CVE Published

Apr 08, 2026 - 12:24 nvd

MEDIUM 5.5

DescriptionCVE.org

A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to.

These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:

{ "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" }

An unauthorized user usually has no way to match these IDs (position) back to individual people.

AnalysisAI

Pretix 2025 and 2026 versions contain an API endpoint authorization bypass that returns all check-in events for an organizer rather than a specific event, exposing ticket scan records (including scan timestamps, results, and ticket IDs) across unauthorized events to authenticated API consumers with high-level organizer privileges. The vulnerability affects pretix 2025.10.0 through 2026.3.0, allowing privileged users to access sensitive event data they should not be permitted to view, though individual attendee identity linkage requires additional context not provided by the API response alone.

Technical ContextAI

The vulnerability stems from improper scope enforcement in a newly introduced API endpoint (CWE-653: Improper Authorization). Rather than filtering check-in event records by the requested event identifier, the endpoint applies authorization logic at the organizer level only, returning all scan events associated with the user's organizer context. Check-in events are sensitive records containing structured data about ticket validations (position IDs, scan timestamps, gate information, and device identifiers). The affected product is pretix, an open-source ticket sales and event management platform (CPE: cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*). The root cause is insufficient parameter validation or query filtering when constructing the API response-the endpoint accepts an event parameter but does not enforce it in the database query or response filtering logic.

RemediationAI

Vendor-released patches are available: upgrade to pretix 2026.2.1 or later (for 2026.2.x branch), pretix 2026.3.1 or later (for 2026.3.x branch), or pretix 2026.1.2 or later (for 2025.10.x through 2026.1.x). Detailed patch information and release notes are available at https://pretix.eu/about/en/blog/20260408-release-2026-3-1/. As an interim workaround, organizations should audit API consumer access controls and revoke high-privilege API credentials for organizers or applications that do not require check-in event API access. Review API logs to identify any unauthorized cross-organizer check-in data access patterns and assess whether exposed check-in events (which contain ticket IDs and scan metadata but not direct PII) have been correlated with external data to re-identify attendees.