pretix, the open-source ticketing and registration system made by pretix GmbH in Heidelberg, shipped two releases in two days this week. On 28 October 2026 it put out security release 2026.8.1, which fixes three vulnerabilities, two of them rated medium. On 29 October it followed with 2026.9.0, a maintenance release that adds Wero as a Stripe payment option, lets organisers send mass emails to add-on ticket holders and gives the Exhibitors plugin webhooks for new leads. Customers on pretix Hosted already run both versions and have nothing to do. If you run pretix on your own server, you need to upgrade. This report is based on the two release posts on the pretix blog; we have not tested either release.
The three security fixes
The security post lists three issues, each with a CVE number, found through outside reports and pretix’s own review.
- Gift card enumeration (medium, CVE-2026-101273). Some API endpoints let an authenticated user create an order payment that pointed at a gift card by its internal ID, without checking that the card belonged to the same organiser. That exposed another organiser’s gift card secret, and a refund on that payment could then raise the card’s value. pretix says it has checked that this was not exploited on pretix Hosted. It rates the issue medium because abuse needs a logged-in account and would be easy to trace.
- Customer account single sign-on (medium, CVE-2026-101274). Where pretix acts as the identity provider for customer accounts, it did not check the requested response type against the grant type set for the SSO client. A client limited to the code flow could still be handed a token. pretix says exploiting it would also need a flaw on the third-party site that embeds the sign-in, and that it could expose a customer’s name, email address and phone number but no order data.
- Shredder export sessions (low, CVE-2026-101272). Files produced by the data shredder through the API were not tied to the right session for token-based API users. pretix calls the risk close to zero because the files sit behind random UUIDs and are deleted after a day, but the fix restores the protection that an earlier release meant to add.
Fixed builds are on PyPI for the last three stable branches: 2026.8.1, 2026.7.3 and an update to the 2026.6 branch, with Docker images following within hours. pretix’s advice for anyone on a version older than 2026.5 is to upgrade to a current release now.
What 2026.9.0 adds
pretix describes 2026.9.0 as mainly maintenance while larger work goes on in the background. The changes most relevant to event teams are these.
- Payments. Wero is now enabled through the Stripe integration, and a new open-source plugin connects to VR Payment’s Wero platform. The Mollie plugin (2.6.0) also enables Wero, although pretix notes it may not be live on every Mollie account yet. A Stripe bug that blocked payment when Affirm or Klarna were switched on without card payments has been fixed.
- Attendee email. Mass emails can now reach holders of add-on tickets, and a new placeholder for the attendee’s name in a salutation has been added. Scheduled emails no longer run when their plugin is turned off.
- Event series. When you bulk-edit dates in a series, admission time and the start and end of sale can now be set relative to each date.
- Exhibitors and lead capture. The Exhibitors plugin (1.18.0) adds webhooks for new leads, so leads scanned at a stand can be pushed to another system as they come in.
- Box office. The pretixPOS backend plugin (3.25.0) adds notifications when a pretixKIOSK changes status, which follows the kiosk check-in work in 2026.8.0.
- Integrations and API. The HubSpot plugin (2.0.4) fixes edge cases, notifications now work at organiser level, and the REST API now checks that a live event still meets every condition for being live when it is updated.
What to do
If you self-host pretix, install 2026.8.1 or the matching fix for your branch first, then plan the move to 2026.9.0, testing the release on a copy before a busy on-sale. Check whether you use gift cards across several organisers on one installation or customer account SSO with a third-party site, as those are the setups the medium-rated issues affect. If you sell to buyers in countries where Wero is in use, look at the new payment option in your Stripe or Mollie settings, and if you run exhibitor lead capture, the new webhook can feed leads straight to your CRM.
Sources
- pretix blog: Security release 2026.8.1 of pretix (28 October 2026)
- pretix blog: Release 2026.9.0 of pretix (29 October 2026)
Sources checked 31 October 2026. Details are taken from pretix’s own release posts. Event Tech News has not tested these releases.
