pretix Authorization Bypass and Payment Validation Flaws (CVE-2026-57532/CVE-2026-18029)

Vulnerability Overview 1. Vulnerability #1: Missing Authorization Check in Event Quick Settings View [LOW] - CVE ID: CVE-2026-57532 - Description: In the "Quick Settings" view after event creation, users can configure key parts of an event with just a few clicks. This view fails to properly verify whether the user has permission to modify the configuration of a given event. An attacker can exploit this vulnerability to create products, quotas, set up bank transfer organizations, or connect Stripe accounts for the same event, even if they only have read-only access. - Severity Rating: Low. This is assessed as low severity because the vulnerability can only be exploited by users within the organization and only on fully unconfigured events. 2. Vulnerability #2: Insufficient Payment Status Verification in pretix-girosolution [MEDIUM] - CVE ID: CVE-2026-18029 - Description: The payment integration with GiroCheckout does not correctly verify payment status responses. An attacker can take a successful payment status response from one transaction and submit it to the system for a different transaction, thereby obtaining multiple valid tickets with only a single payment. - Severity Rating: Medium. This is assessed as medium severity because there is no data leakage, and the likelihood of large-scale exploitation is low. Affected Versions Vulnerability #1: All currently supported versions are affected (except for the patched versions listed below). Vulnerability #2: All currently supported versions are affected (except for the patched versions listed below). Remediation Fixed Versions: - pretix 2026.6.1 - pretix 2026.5.4 - pretix 2026.4.6 - pretix-girosolution 1.0.1 (Enterprise Plugin) Recommendations: - Users are strongly advised to update to the patched versions listed above as soon as possible. - For customers using the pretix hosted service, the vulnerabilities have already been fixed, and no further action is required. - Users are encouraged to regularly update to the latest version of pretix, as every release contains useful and important bug fixes, even if they are not security-related. Additional Information Reported By: - Vulnerability #1 was reported by dizconnetz. - Vulnerability #2 was discovered internally. Contact Information: - For any security issues or questions, please contact security@pretix.eu. Summary This security update addresses two vulnerabilities concerning event configuration and payment status verification. Users are advised to update to the specified versions as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

pretix Authorization Bypass and Payment Validation Flaws (CVE-2026-57532/CVE-2026-18029)