emails sent by pretix use placeholders that are replaced with customer data; an attacker who can set email templates could craft names like {{event.__init__.__code__.co_filename}} to leak configuration files, database passwords, and API keys. The bug stems from inadequate validation of placeholder names, exposing the system to credential disclosure. The weakness corresponds to CWE-627, where untrusted input is used to evaluate code paths that can read sensitive data.

The affected product is pretix, specifically the pretix and double_opt_in_step modules listed by the CNA. Version information is not disclosed in the available data, so any installation running these modules remains potentially vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. It is not listed in the CISA KEV catalog. An attacker must have the ability to modify email templates, which is typically granted to any backend user. Therefore, the risk is driven by the breadth of backend user privileges; restricting template editing or limiting backend access reduces the attack surface.