Emails sent by pretix can include placeholders that expand with customer data. A vulnerability allows attackers to craft placeholder names that access internal files, revealing database passwords, API keys, or other secrets via the email subject and body. The bug arises because untrusted placeholders are evaluated twice and the sanitization for malicious names is incomplete, enabling information leakage to users who can edit email templates or to ticket buyers who control limited placeholders such as {invoice_company}. The flaw therefore permits the exfiltration of highly confidential configuration data and constitutes a CWE-627 lack of authorization boundary vulnerability.

Pretix installations that support the email template feature are potentially affected. The product in question is pretix by pretix. No specific version range is provided in the CVE, so all versions that use the template system should be examined for the applied patch.

With a CVSS score of 7.5, the vulnerability is in the high severity range. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, indicating a low current exploitation probability. However, the attack can be executed by any user who can edit templates in the backend, and to a limited extent by ticket buyers who can set certain placeholders. Successful exploitation leads to disclosure of database credentials, API keys, and potentially other system configuration data, impacting confidentiality but not integrity or availability directly.