GHSA-r8p8-qw9w-j9qv
NoneCVSS
—
EPSS
—
Published
Feb 16, 2026
CISA due date
—
The record
pretix unsafely evaluates variables in emails
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pretix | 0 | 2025.9.4 |
| PyPI | pretix | 2025.10.0 | 2025.10.2 |
| PyPI | pretix | 2026.1.0 | 2026.1.1 |
Related vulnerabilities
- CVE-2026-2415 Emails sent by pretix can utilize placeholders that will be filled with customer data. Same vulnerability
- GHSA-r2h2-g46h-8mx8 pretix has Broken Access Control Allowing Cross-User File Access via UUID Also affects pretix
- GHSA-pmjj-h5jm-vxh4 pretix has Broken Access Control Allowing Cross-User File Access via UUID Also affects pretix
- CVE-2025-14882 An API endpoint allowed access to sensitive files from other users by knowing the UUID of… Also affects pretix
- CVE-2025-14881 Multiple API endpoints allowed access to sensitive files from other users by knowing the… Also affects pretix
- CVE-2026-2451 Emails sent by pretix can utilize placeholders that will be filled with customer data. CWE-627
- CVE-2026-2452 Emails sent by pretix can utilize placeholders that will be filled with customer data. CWE-627