CVE-2026-2415

CVE-2026-2415 affects pretix, specifically its email placeholder mechanism. It allows authenticated attackers (pretix backend users) to exfiltrate sensitive system configuration data, including database passwords and API keys, through specially crafted placeholders in email subjects. A secondary flaw allowed double evaluation of placeholders, potentially enabling ticket buyers to trigger the initial vulnerability, though this scenario is less likely. The vulnerability has a CVSSv4 score of 7.5 (HIGH), indicating a network attack vector with high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. The EPSS score is low, suggesting a low probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) or significant community discussion or media coverage has been identified for this CVE. Organizations using pretix are advised to rotate all passwords and API keys in their pretix.cfg file as a precautionary measure.