CVE-2026-101267

LowCVSS 2.7/10Last modified Sep 29, 2026

Description

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

Metrics

CVSS 4.0 2.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
pretix	pretix	>= 0.0, < 2026.5.5; >= 2026.6.0, < 2026.6.2; >= 2026.7.0, < 2026.7.1

References

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1012681.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the CVE-2026-1012692.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used CVE-2026-101276.3A weakness has been identified in Edimax BR-6478AC 1.23. This affects the function formStaDrvSetup of the file /goform/formStaDrvSetup of th CVE-2026-1012702.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.CVE-2026-1012712.1OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is CVE-2026-1012722.3The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session CVE-2026-1012735.3Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was no CVE-2026-1012746.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the CVE-2026-1012756.3Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status res CVE-2026-1012769.2iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees s CVE-2026-1012776.5A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the function dkim_process_set o CVE-2026-1012784.3A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_tld of the file libo