CVE Feed

    Dashboard / CVE / CVE-2026-101268

    CVE-2026-101268

    If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

    Published:Sep 29, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 29, 2026
    EPSS Score:
    CVSS Score:1.7

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-384 Session Fixation

    Related CVEs

    CVE-2026-101272 (CVSS 2.3) — The mechanism binding files generated during a shredding process to the authentication method is not working c…
    CVE-2026-101274 (CVSS 6.9) — When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system…
    CVE-2026-101273 (CVSS 5.3) — Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-increment…
    CVE-2026-101271 (CVSS 2.1) — OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth…
    CVE-2026-101270 (CVSS 2.1) — Malicious HTML content could be injected into the help texts of various fields with organizer permissions.…
    CVE-2026-101269 (CVSS 2.3) — The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and …
    CVE-2026-101267 (CVSS 2.7) — A missing permission check allowed low-privileged users with access to an event but without access to the even…
    CVE-2026-101266 (CVSS 1.3) — A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping…
    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High