Pretix vulnerabilities
We track 4 vulnerabilities in Pretix products across 9 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on July 1, 2026.
Latest Pretix vulnerabilities
- 7.7 High severity
We found a chain of combining multiple weaknesses in the product that could allow an attacker…
We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bit
- 9.0 Critical severity
The payment integration pretix-oppwa provides support for the payment providers VR Payment…
The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirecte
- 8.8 High severity
pretix: Improper Neutralization of Script-Related HTML Tags in a Web Page
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due
- 7.3 High severity
A user with permission "update world" in any Venueless world is able to exfiltrate chat…
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attac