Compliance Impact

This vulnerability allows unauthorized API consumers to access sensitive check-in event data across multiple events under the same organizer, which may include detailed records of ticket scans and associated metadata.

Such unauthorized data exposure could potentially lead to non-compliance with data protection regulations like GDPR or HIPAA, as it involves improper access control and leakage of potentially sensitive event-related information.

However, the provided information does not explicitly state the impact on compliance with these standards or any regulatory consequences.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-5600 is a medium-severity vulnerability in pretix introduced in version 2025. It involves an API endpoint that was intended to return all check-in events for a specific event. However, due to improper access control, this endpoint instead returns all check-in events for the entire organizer. This means an unauthorized API consumer can access sensitive check-in data across multiple events under the same organizer, which they should not have permission to view.

The exposed data includes detailed records of ticket scans such as the time and result of each scan, ticket ID, position, datetime, list ID, creation time, whether the check-in was automatic, gate, and device identifiers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive event check-in data across multiple events managed by the same organizer. An attacker or unauthorized API consumer could access detailed ticket scan information, potentially compromising event security and privacy.

Although the exposed data does not directly link ticket positions to individual people, the information about ticket scans, times, and devices could still be used maliciously to infer patterns or gain unauthorized insights into event attendance.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an API endpoint in pretix that returns check-in event data for all events under an organizer instead of a specific event. Detection would involve monitoring API calls to this endpoint and checking if responses include data beyond the requested event scope.

Specifically, you can inspect network traffic or API logs for requests to the check-in events API endpoint and verify if the returned data contains check-in records from multiple events rather than a single event.

Since the vulnerability is related to unauthorized access to data, commands or tools that capture and analyze HTTP API traffic (such as curl, wget, or API testing tools like Postman) can be used to manually query the endpoint and inspect the returned JSON data for unexpected event data.

• Use curl to query the API endpoint for a specific event and inspect if the response contains check-in data from other events: curl -H "Authorization: Bearer <token>" https://<pretix-server>/api/checkin/events/<event_id>/
• Analyze API logs or network captures (e.g., using tcpdump or Wireshark) to identify responses containing check-in data that includes multiple event IDs or organizer-wide data.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update pretix to a fixed version where this vulnerability has been resolved.

• Upgrade pretix to version 2026.3.1, 2026.2.1, or 2026.1.2 or later, as these versions contain the fix for this vulnerability.
• If you are using the pretix Hosted service, no action is required as the service has already been protected.

Until the update is applied, restrict access to the vulnerable API endpoint to trusted users only and monitor API usage for suspicious access patterns.

Useful 0 Not Useful 0