CVE-2023-27891

Insufficient Session Expiration in pretix

7.5 HighFix available

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.62%Up 0.6 points since Mar 7, 2023

What each source reports

NVD Score used 7.5

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: CVE-2023-27891
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-613
Updated: 2026-11-02

CVE List No score

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: CVE-2023-27891
Updated: 2026-11-02

EUVDEUVD-2023-0208 0.0

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: EUVD-2023-0208
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-r76w-3wwq-jv6v 8.7

Insufficient Session Expiration in pretix

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: GHSA-r76w-3wwq-jv6v
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-613
Updated: 2026-11-02

OSVGHSA-r76w-3wwq-jv6v 8.7

Insufficient Session Expiration in pretix

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: GHSA-r76w-3wwq-jv6v
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-613
Updated: 2026-11-02

OSV No score

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: CVE-2023-27891
Updated: 2026-11-02

OSVPYSEC-2023-42 No score

rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

Record: PYSEC-2023-42
Updated: 2026-11-02

Affected products

rami pretix

Affected packages

Affected packages
Package	Affected	Fixed
`pretix` PyPI	4.17.0 up to 4.17.1	4.17.1
`pretix` PyPI	4.16.0 up to 4.16.1	4.16.1
`pretix` PyPI	before 4.15.1	4.15.1
`pretix` PyPI	before 4.15.1, plus listed versions 1.0.01.0.0b11.0.0b21.1.01.1.1 Show 45 moreShow less 1.1.21.1.31.10.01.10.11.11.01.11.11.12.01.12.11.13.01.13.11.14.01.15.01.15.11.15.21.16.01.17.01.17.11.2.01.2.1.post21.2.21.3.01.3.0.post11.3.11.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.7.11.7.21.8.01.8.11.9.01.9.12.0.02.1.02.2.02.3.02.4.02.5.02.6.02.7.0	4.15.1
`pretix` PyPI	before 4.17.1, plus listed versions 1.0.01.0.0b11.0.0b21.1.01.1.1 Show 45 moreShow less 1.1.21.1.31.10.01.10.11.11.01.11.11.12.01.12.11.13.01.13.11.14.01.15.01.15.11.15.21.16.01.17.01.17.11.2.01.2.1.post21.2.21.3.01.3.0.post11.3.11.4.01.4.11.5.01.5.11.5.21.6.01.6.11.6.21.7.11.7.21.8.01.8.11.9.01.9.12.0.02.1.02.2.02.3.02.4.02.5.02.6.02.7.0	4.17.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27891 is a high vulnerability (CVSS 7.5) in Rami Pretix, published March 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 50th percentile. Fixed in pretix 4.17.1.

References

This page doesn't list everything

Left out here: 120 versions. The JSON record has them.