CVE-2026-5600

OVERVIEW CVE-2026-5600 is an authorization bypass vulnerability affecting pretix 2025, specifically a newly introduced API endpoint designed to retrieve check-in events for a specific event. Due to improper access controls, the endpoint returns all check-in events associated with the organizer rather than limiting results to the requested event, allowing unauthorized API consumers to access ticket scan data across multiple events they should not have permissions to view. The exposed records contain sensitive check-in information including scan timestamps, results, ticket IDs, and device information. SEVERITY The vulnerability has a FAUCET Risk Score of 41.0/100, indicating moderate concern. The attack vector is network-based through the API endpoint, and exploitation requires minimal complexity as an attacker need only possess valid API credentials for any event under the target organizer. The impact is primarily informational disclosure, as attackers gain unauthorized visibility into ticket scanning activity, timing patterns, and ticket matching data across the organization. While the exposed ticket position IDs cannot be easily correlated to individual attendees without additional data, the broader operational and competitive intelligence gained from comprehensive check-in patterns represents a meaningful privacy and business confidentiality risk. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no public exploit code is currently available. The EPSS score of 0.00016 indicates very low predicted probability of exploitation, suggesting minimal community attention or attacker interest at present. Organizations using pretix 2025 should prioritize patching, but the threat level remains low based on current exploit activity.