{"cve":"CVE-2026-5600","nvd":{"published":"2026-04-08T13:16:43.543","modified":"2026-07-24T20:10:00.147","status":"Analyzed","description":"A new API endpoint introduced in pretix 2025 that is supposed to \nreturn all check-in events of a specific event in fact returns all \ncheck-in events belonging to the respective organizer. This allows an \nAPI consumer to access information for all other events under the same \norganizer, even those they should not have access to.\n\n\nThese records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:\n\n\n{\n  \"id\": 123,\n  \"successful\": true,\n  \"error_reason\": null,\n  \"error_explanation\": null,\n  \"position\": 321,\n  \"datetime\": \"2020-08-23T09:00:00+02:00\",\n  \"list\": 456,\n  \"created\": \"2020-08-23T09:00:00+02:00\",\n  \"auto_checked_in\": false,\n  \"gate\": null,\n  \"device\": 1,\n  \"device_id\": 1,\n  \"type\": \"entry\"\n}\n\n\n\nAn unauthorized user usually has no way to match these IDs (position) back to individual people.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H","score":5.5},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-653"],"references":["https://pretix.eu/about/en/blog/20260408-release-2026-3-1/"],"products":["pretix:pretix"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-5600","score":0.00255,"percentile":0.17177,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-wr8q-c73g-m7gp","url":"https://osv.dev/vulnerability/GHSA-wr8q-c73g-m7gp","summary":"pretix: API leaks check-in data between events of the same organizer","modified":"2026-06-08T19:15:13.972113663Z","packages":[{"ecosystem":"PyPI","name":"pretix","purl":"pkg:pypi/pretix","ranges":[">=2026.3.0 <2026.3.1"],"fixed":["2026.3.1"]},{"ecosystem":"PyPI","name":"pretix","purl":"pkg:pypi/pretix","ranges":[">=2026.2.0 <2026.2.1"],"fixed":["2026.2.1"]},{"ecosystem":"PyPI","name":"pretix","purl":"pkg:pypi/pretix","ranges":[">=2025.10.0 <2026.1.2"],"fixed":["2026.1.2"]}]},{"id":"PYSEC-2026-111","url":"https://osv.dev/vulnerability/PYSEC-2026-111","summary":"","modified":"2026-06-10T17:02:31.099347728Z","packages":[{"ecosystem":"PyPI","name":"pretix","purl":"pkg:pypi/pretix","ranges":[">=2025.10.0 <2026.1.2",">=2026.2.0 <2026.2.1",">=2026.3.0 <2026.3.1"],"fixed":["2026.1.2","2026.2.1","2026.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}