CVE-2026-2452: pretix Information Disclosure Vulnerability

CVE-2026-2452 Overview

CVE-2026-2452 is an information disclosure vulnerability in pretix, an open-source event ticketing system. The vulnerability exists in the email template placeholder mechanism, which allows authenticated users with backend access to craft malicious placeholder names that can exfiltrate sensitive system configuration data, including database passwords and API keys.

Critical Impact

Attackers with access to pretix backend email templates can extract sensitive configuration data including database credentials and API keys through specially crafted placeholder injection.

Affected Products

• pretix (versions prior to 2026.1.1)
• pretix self-hosted installations with email template functionality

Discovery Timeline

• February 16, 2026 - CVE-2026-2452 published to NVD
• February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2452

Vulnerability Analysis

This vulnerability is classified as CWE-627 (Dynamic Variable Evaluation), a category of flaws where user-controlled input can influence the evaluation of dynamic variables or code paths. In the context of pretix, the email templating system allows administrators to use placeholders like {name} that get replaced with customer data when emails are sent.

The core issue stems from insufficient validation of placeholder names before they are processed by the template engine. While pretix included safeguards to prevent malicious placeholder usage, a coding error rendered these protections ineffective for certain plugin contexts. This allowed attackers to leverage Python's object introspection capabilities to traverse the object hierarchy and access internal attributes.

Root Cause

The root cause is improper input validation in the email template placeholder processing mechanism. The security controls designed to prevent arbitrary attribute access through placeholder names were not fully effective due to a mistake in the code implementation. This allowed attackers to use Python dunder (double underscore) methods like __init__ and __code__ to traverse object internals and access sensitive attributes such as co_filename (which reveals file system paths) and potentially configuration values.

Attack Vector

The attack requires network access and a valid authenticated session with permissions to modify email templates in the pretix backend. An attacker would craft a malicious email template containing specially constructed placeholder names that exploit Python's object model.

For example, a placeholder such as {{event.__init__.__code__.co_filename}} would traverse from the event object to its constructor method, then to the code object, and finally extract the filename of the source code. More sophisticated traversals could potentially reach configuration objects containing database passwords or API keys stored in pretix.cfg.

The attacker would then trigger the email sending functionality (such as sending a test email or waiting for an event-triggered email) to receive the exfiltrated data in the rendered email output.

Detection Methods for CVE-2026-2452

Indicators of Compromise

• Unusual email templates containing double underscore (__) sequences in placeholder names
• Email templates with references to Python internal attributes like __init__, __code__, __globals__, or __dict__
• Email logs showing rendered content containing file paths, configuration values, or credential-like strings
• Backend audit logs showing frequent email template modifications by users

Detection Strategies

• Implement monitoring for email template changes that include dunder method references or attribute traversal patterns
• Review email template modification logs for suspicious placeholder patterns matching regex \{\{.*__.*__.*\}\}
• Audit all existing email templates for malicious placeholder injection patterns
• Monitor outbound emails for content anomalies that may indicate successful data exfiltration

Monitoring Recommendations

• Enable comprehensive audit logging for all email template modifications in pretix
• Configure alerts for email templates containing Python object introspection patterns
• Implement content inspection on outbound emails to detect potential data leakage
• Review access logs for backend users with email template modification permissions

How to Mitigate CVE-2026-2452

Immediate Actions Required

• Update pretix to version 2026.1.1 or later immediately
• Rotate all passwords and API keys contained in your pretix.cfg configuration file as recommended by the vendor
• Audit existing email templates for any malicious placeholder patterns
• Review backend user access logs to identify potential exploitation attempts
• Restrict email template modification permissions to trusted administrators only

Patch Information

The pretix development team has released version 2026.1.1 which addresses this vulnerability. The security fix corrects the code path that allowed bypass of the placeholder validation mechanism. Administrators should upgrade their pretix installations immediately. For detailed information about the release, refer to the Pretix Blog Release Announcement.

Workarounds

• If immediate patching is not possible, temporarily disable email template customization features
• Restrict backend access to only essential personnel until the patch is applied
• Implement additional network-level monitoring for suspicious outbound email content
• Review and revoke unnecessary backend user accounts with email template permissions

# Configuration rotation example for pretix.cfg
# After updating pretix, rotate all sensitive credentials:

# 1. Generate new database password
NEW_DB_PASS=$(openssl rand -base64 32)

# 2. Update database user password
# mysql -u root -p -e "ALTER USER 'pretix'@'localhost' IDENTIFIED BY '$NEW_DB_PASS';"

# 3. Update pretix.cfg with new credentials
# Ensure all API keys and passwords in pretix.cfg are rotated

# 4. Restart pretix services
systemctl restart pretix-web pretix-worker