Threats affecting pkg:github/pretix

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.

CVE-2026-101274 is a vulnerability in pretix's Single-Sign-On (SSO) implementation where the system fails to properly validate the response_type parameter against the configured grant type for an SSO client. This allows an attacker to receive a valid token with an unauthorized response_type if they can run JavaScript on a trusted redirect URI page. The issue affects multiple pretix versions prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.

A vulnerability in pretix API endpoints allowed unauthorized referencing of gift cards by exploiting predictable internal IDs. Attackers could create payments linked to gift cards from other organizers without charging the gift card, then trigger refunds to increase the gift card's value. This flaw affects multiple versions of pretix prior to fixed releases in 2026.6.4, 2026.7.3, and 2026.8.1.

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.

pretix before 2024.1.1 mishandles file validation.