A flaw in pretix allows an organizer user to insert arbitrary HTML into help text fields. The injected content can modify the appearance of the interface and, if malicious scripts are included, can execute client‑side code in the browsers of other users who view the altered help text. This behavior aligns with the classic HTML injection weakness defined by CWE‑79.

Pretix, a ticket‑ing platform, is affected by this vulnerability. The CVE does not specify a precise version range, but the impact applies to releases prior to the vendor’s 2026‑07‑01 update referenced in the advisory. All earlier versions that have not applied a fix are therefore susceptible.

The CVSS base score of 2.1 indicates low severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity. The attack requires an authenticated organizer user with permission to edit help text, making the likely vector internal. Although the risk to confidentiality and integrity is modest, the XSS potential can affect any user who views the compromised help text.