CVE-2026-2451: pretix Information Disclosure Vulnerability

CVE-2026-2451 Overview

CVE-2026-2451 is an information disclosure vulnerability in pretix, an open-source ticketing software. The vulnerability exists in the email template placeholder mechanism, which allows users to include dynamic customer data in emails. Due to a flaw in the placeholder sanitization logic, an attacker with access to email template configuration could craft malicious placeholder names to exfiltrate sensitive system information, including database passwords and API keys.

Critical Impact

Authenticated users with email template access can extract sensitive configuration data including database credentials and API keys from the pretix system.

Affected Products

• Pretix (versions prior to 2026.1.1)
• Pretix email template plugin

Discovery Timeline

• 2026-02-16 - CVE-2026-2451 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2451

Vulnerability Analysis

This vulnerability is classified under CWE-627 (Dynamic Variable Evaluation). Pretix's email templating system allows administrators to use placeholders like {name} that get replaced with customer data when emails are sent. The system was designed with security controls to prevent access to internal Python objects and sensitive configuration data through these placeholders.

However, a coding error in the placeholder validation logic meant these protections were not fully effective for the email plugin. An attacker could bypass the intended restrictions by constructing specially crafted placeholder expressions that traverse Python's object model to access internal system attributes.

Root Cause

The root cause is improper input validation in the email template placeholder processing code. While pretix implemented mechanisms to block malicious placeholder patterns, a mistake in the implementation caused these security checks to be incomplete or improperly applied to the email plugin specifically. This allowed attackers to use Python introspection techniques through placeholder expressions to access protected attributes.

Attack Vector

The attack requires network access and authenticated access to the pretix backend with email template editing permissions. An attacker would craft a malicious email template containing placeholder expressions designed to traverse Python's object hierarchy. When the template is processed, these expressions would be evaluated, allowing access to sensitive attributes such as code filenames, configuration values, and potentially credentials stored in the pretix.cfg file.

For example, an attacker could use expressions like {{event.__init__.__code__.co_filename}} to retrieve filesystem paths, and similar techniques to access database connection strings or API credentials. The exfiltrated data would then be included in the rendered email output, allowing the attacker to harvest sensitive system information.

Detection Methods for CVE-2026-2451

Indicators of Compromise

• Email templates containing unusual placeholder patterns with Python dunder attributes (e.g., __init__, __code__, __class__)
• Templates referencing internal Python object attributes like co_filename, co_code, or similar introspection properties
• Unexpected modifications to email templates by users who typically don't manage templates
• Emails containing system paths, configuration values, or credential-like strings in unexpected locations

Detection Strategies

• Audit email templates for placeholder patterns containing double underscores or Python introspection attributes
• Review pretix backend access logs for template modification activities
• Implement content inspection on outbound emails for sensitive data patterns
• Monitor for unusual email template edits, particularly those containing complex nested placeholder expressions

Monitoring Recommendations

• Enable detailed logging for email template modifications in pretix
• Set up alerts for email templates containing suspicious placeholder patterns
• Review user access permissions for email template functionality regularly
• Monitor outbound email content for potential data exfiltration indicators

How to Mitigate CVE-2026-2451

Immediate Actions Required

• Upgrade pretix to version 2026.1.1 or later immediately
• Rotate all passwords and API keys contained in your pretix.cfg file
• Review existing email templates for any suspicious or malicious placeholder patterns
• Audit user access to identify which accounts have email template editing permissions
• Review email logs for any templates that may have been exploited

Patch Information

Pretix has released version 2026.1.1 which addresses this vulnerability. The patch corrects the placeholder validation logic to properly sanitize template expressions across all plugins including the email functionality. Organizations should upgrade immediately and follow the vendor's recommendation to rotate all credentials stored in configuration files as a precautionary measure.

For detailed information about the fix, see the Pretix Blog Release Announcement.

Workarounds

• Restrict email template editing permissions to only essential administrative users until the patch can be applied
• Implement a review process for all email template changes before deployment
• Consider temporarily disabling custom email templates if feasible for your operation
• Monitor and audit all email template modifications closely

# Configuration example - Rotate credentials after patching
# Update pretix.cfg with new credentials

# 1. Stop pretix services
systemctl stop pretix

# 2. Update database password in pretix.cfg
# [database]
# password = <new_secure_password>

# 3. Update any API keys in configuration
# [api]
# key = <new_api_key>

# 4. Restart pretix services
systemctl start pretix