Technical impact
A missing permission check in pretix allowed any user who had event access but did not have access to the event's orders to retrieve the number of attendees and the total revenue. This flaw exposes confidential business information, such as attendance figures and financial totals, that should be restricted to authorized personnel. The vulnerability is an instance of improper authorization (CWE‑862).
Affected Systems
The problem affects pretix installations where a user is granted basic event visibility but is not authorized to view order data. No specific product version is listed, so the issue may exist in all releases prior to any patch that corrects this permission check.
Risk and Exploitability
The CVSS score of 2.7 classifies the vulnerability as low severity, and the EPSS score is not available. It is not listed in the CISA KEV catalog. An attacker can exploit the flaw simply by accessing the event interface with limited permissions; no advanced conditions or exploits are required.
