A newly introduced API endpoint in pretix 2025 was intended to return check‑in events for a single event but, due to a logic error, returns all check‑in events belonging to the same organizer. The response contains detailed records of each ticket scan, including timestamps, gate and device identifiers, success indicators, and scan list information. The exposed data leaks attendance patterns and potentially sensitive event information to anyone who can invoke the endpoint. This constitutes a lateral information disclosure weakness identified as CWE‑653.

The vulnerability affects the pretix event management platform. All instances that have incorporated the 2025 API implementation are susceptible, including any version running from 2025 onward until the issue is patched. The product identifier is pretix:pretix and the specific affected versions are those that have not yet applied the 2026.3.x update released to address the endpoint bug.

The CVSS score of 5.5 signals a moderate risk primarily rooted in privacy concern rather than direct system compromise. EPSS data is unavailable and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is through an unauthorized or improperly scoped API call; it is inferred that an attacker would need an authenticated API client or a compromised token to access the endpoint, yet even that may not be required if the endpoint does not enforce proper ownership checks. The exposure can lead to regulatory, reputational, or legal repercussions for event organizers, especially in jurisdictions with strict data protection laws.