CVE-2026-101266

LowCVSS 1.3/10Last modified Sep 29, 2026

Description

A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.

Metrics

CVSS 4.0 1.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
pretixpretix>= 0.0, < 2026.5.5; >= 2026.6.0, < 2026.6.2; >= 2026.7.0, < 2026.7.1

References

Timeline

Published
Sep 29, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1012672.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some speCVE-2026-1012681.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the CVE-2026-1012692.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is usedCVE-2026-101276.3A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of thCVE-2026-1012702.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.CVE-2026-1012712.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is CVE-2026-1012722.3The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session CVE-2026-1012735.3Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was noCVE-2026-1012746.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate theCVE-2026-1012756.3Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status resCVE-2026-1012769.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees sCVE-2026-1012776.5A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set o
CVE-2026-101266: Low severity, CVSS 1.3 | Vulnix