CVE Feed

    Dashboard / CVE / CVE-2026-101269

    CVE-2026-101269

    The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

    Published:Sep 29, 2026
    Last Modified:Sep 29, 2026
    EPS:Sep 29, 2026
    EPSS Score:
    CVSS Score:2.3

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2026-101272 (CVSS 2.3) — The mechanism binding files generated during a shredding process to the authentication method is not working c…
    CVE-2026-101274 (CVSS 6.9) — When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system…
    CVE-2026-101273 (CVSS 5.3) — Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-increment…
    CVE-2026-101271 (CVSS 2.1) — OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth…
    CVE-2026-101270 (CVSS 2.1) — Malicious HTML content could be injected into the help texts of various fields with organizer permissions.…
    CVE-2026-101268 (CVSS 1.7) — If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attack…
    CVE-2026-101267 (CVSS 2.7) — A missing permission check allowed low-privileged users with access to an event but without access to the even…
    CVE-2026-101266 (CVSS 1.3) — A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping…
    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High