Pretix API Check-In Data Exposure Vulnerability

A vulnerability in the Pretix API introduced in version 2025 allows unauthorized access to check-in events across all events of the same organizer. Instead of limiting the data to a specific event, the endpoint exposes check-in information for all events under the organizer's account, including details such as ticket scan times, results, and ticket IDs. This issue could lead to unauthorized data access, especially for organizers hosting third-party events.

Impact

Exploitation of this vulnerability could result in unauthorized access to check-in data from multiple events under the same organizer, potentially allowing API consumers to piece together information about ticket holders, despite the absence of direct personal identifiers.

Remediation

Users are advised to update to Pretix versions 2026.3.1, 2026.2.1, or 2026.1.2, all of which include the necessary fix. For those using the Pretix Hosted service, the vulnerability has already been addressed.