CVE Feed

    Dashboard / CVE / CVE-2026-101267

    CVE-2026-101267

    A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

    Published:Sep 29, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 29, 2026
    EPSS Score:
    CVSS Score:2.7

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-101272 (CVSS 2.3) — The mechanism binding files generated during a shredding process to the authentication method is not working c…
    CVE-2026-101274 (CVSS 6.9) — When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system…
    CVE-2026-101273 (CVSS 5.3) — Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-increment…
    CVE-2026-101271 (CVSS 2.1) — OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth…
    CVE-2026-101270 (CVSS 2.1) — Malicious HTML content could be injected into the help texts of various fields with organizer permissions.…
    CVE-2026-101269 (CVSS 2.3) — The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and …
    CVE-2026-101268 (CVSS 1.7) — If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attack…
    CVE-2026-101266 (CVSS 1.3) — A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping…
    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High