CVE-2023-27891: Insufficient Session Expiration in pretix
Summary
CVE-2023-27891: Insufficient Session Expiration in pretix. Affects pretix across 3 version ranges.
< 4.15.1
>= 4.16.0, < 4.16.1
>= 4.17.0, < 4.17.1
Fixed in 4.15.1, 4.16.1 or 4.17.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pretix is an open-source ticket sales and event management platform written in Python. It allows event organizers to create and manage ticket sales for various types of events. The vulnerability in pretix versions before 4.17.1 allows OAuth application authorization from a logged-out session.
Vulnerability Detail
The vulnerability arises from the lack of proper session expiration handling in pretix. This allows an attacker to perform OAuth application authorization even when the user is logged out. An attacker could exploit this vulnerability to gain unauthorized access to user accounts or perform malicious actions on behalf of the user. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 2026.8.0 as of 22 Oct 2026
pip install --upgrade "pretix==2026.8.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.15.14.15.1pip install --upgrade "pretix==4.15.1" -
>= 4.16.0, < 4.16.14.16.1pip install --upgrade "pretix==4.16.1" -
>= 4.17.0, < 4.17.14.17.1pip install --upgrade "pretix==4.17.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version to mitigate the risk.
Conclusion
The vulnerability in pretix versions before 4.17.1 allows unauthorized OAuth application authorization from a logged-out session. It is crucial to update pretix to version 4.17.1 to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pretix →
FAQ
pretix is an open-source ticket sales and event management platform.
This vulnerability allows unauthorized OAuth application authorization, potentially leading to unauthorized access to user accounts or malicious actions on behalf of the user.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, update pretix to version 4.17.1.
There is no known workaround. Updating to the fixed version is necessary.
Related vulnerabilities
Recent vulnerabilities recorded for pretix.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
