CVE-2026-5600: 
Python vulnerability analysis and mitigation

CVE-2026-5600 is an improper API isolation vulnerability in pretix, an open-source ticketing software, where a new check-in API endpoint introduced in pretix 2025 incorrectly returns all check-in events belonging to an organizer rather than scoping results to the specific event requested. This allows an authenticated API consumer with access to one event to read check-in records for all other events managed by the same organizer. Affected versions are 2025.10.0 through 2026.1.1, 2026.2.0, and 2026.3.0; patched versions are 2026.1.2, 2026.2.1, and 2026.3.1. The vulnerability was disclosed on April 8, 2026, with a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory).

The root cause is CWE-653 (Improper Isolation or Compartmentalization): the new check-in API endpoint fails to filter query results by the requested event, instead returning all check-in records scoped to the organizer account (Github Advisory). An attacker with a valid API token for any single event under an organizer can send a standard authenticated GET request to the check-in endpoint and receive records — including ticket scan timestamps, scan outcomes (success/failure), error reasons, ticket position IDs, device IDs, and gate information — for all other events under that organizer. Exploitation requires low attack complexity but does require the attacker to already hold API credentials (high privileges in CVSS v4 terms) and the presence of multiple events under the same organizer account.

Successful exploitation allows an authenticated API user to access check-in data across all events managed by the same organizer, even events for which they have no explicit authorization. Exposed data includes ticket scan timestamps, scan results, error explanations, ticket position IDs, device identifiers, and check-in list references. While position IDs cannot typically be directly mapped back to individual attendees without additional data, the exposure of event attendance patterns and operational data represents a meaningful confidentiality breach, particularly for organizers running sensitive or private events (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for a valid API token, limiting the attack surface to authenticated API consumers.

1. Obtain API credentials: Acquire a valid pretix API token for any event under the target organizer — this could be through a legitimate account, a compromised token, or a low-privilege event access grant.
2. Identify the check-in API endpoint: Locate the organizer-scoped check-in events API endpoint introduced in pretix 2025 (e.g., /api/v1/organizers/{organizer}/checkinrequests/).
3. Send authenticated request: Issue a GET request to the check-in endpoint using the obtained API token, specifying any event slug the attacker has access to.
4. Receive cross-event data: Due to the missing event-level filter, the API response returns check-in records for all events under the organizer, not just the requested event — including scan timestamps, results, ticket position IDs, and device information.
5. Enumerate and analyze: Paginate through the full result set to collect check-in intelligence across all organizer events, potentially correlating data with other sources to identify attendance patterns (Github Advisory).

• Network: Unusual volume of API requests to the check-in endpoint from a single API token, especially requests returning data for events outside the token's assigned scope; API calls querying check-in data for event slugs the token should not have access to.
• Logs: pretix API access logs showing a single API token or user account querying check-in data across multiple event slugs in a short time window; large paginated responses from the check-in endpoint inconsistent with the size of the authorized event.
• Application: API tokens associated with limited-scope event access generating responses containing check-in records from other events (detectable via log volume or response size anomalies).

Organizations should upgrade pretix to the patched versions: 2026.1.2, 2026.2.1, or 2026.3.1 depending on their release branch (Github Advisory, pretix Blog). For environments unable to patch immediately, restrict API access by auditing and revoking API tokens for accounts that do not require multi-event visibility, and implement network-level controls to limit access to the check-in API endpoint. Audit API access logs for cross-event data access patterns and disable tokens for accounts showing suspicious activity.

The vulnerability was noted in automated CVE tracking feeds and vulnerability databases shortly after disclosure on April 8, 2026, with coverage on platforms including Bluesky CVE feeds and security aggregators such as cvefeed.io and vuldb.com. A brief technical write-up was published at infinitsec.net. No significant vendor statements beyond the pretix release blog post or notable independent researcher commentary have been identified.