CVE-2026-5600
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
08/04/2026
Última modificación:
08/04/2026
Descripción
*** Pendiente de traducción *** A new API endpoint introduced in pretix 2025 that is supposed to <br />
return all check-in events of a specific event in fact returns all <br />
check-in events belonging to the respective organizer. This allows an <br />
API consumer to access information for all other events under the same <br />
organizer, even those they should not have access to.<br />
<br />
<br />
These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example:<br />
<br />
<br />
{<br />
"id": 123,<br />
"successful": true,<br />
"error_reason": null,<br />
"error_explanation": null,<br />
"position": 321,<br />
"datetime": "2020-08-23T09:00:00+02:00",<br />
"list": 456,<br />
"created": "2020-08-23T09:00:00+02:00",<br />
"auto_checked_in": false,<br />
"gate": null,<br />
"device": 1,<br />
"device_id": 1,<br />
"type": "entry"<br />
}<br />
<br />
<br />
<br />
An unauthorized user usually has no way to match these IDs (position) back to individual people.
Impacto
Puntuación base 4.0
5.50
Gravedad 4.0
MEDIA