CVE Feed

    Dashboard / CVE / CVE-2026-101272

    CVE-2026-101272

    The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.

    Published:Oct 28, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 28, 2026
    EPSS Score:
    CVSS Score:2.3

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-50 Password Recovery Exploitation

    Related CVEs

    CVE-2026-101274 (CVSS 6.9) — When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system…
    CVE-2026-101273 (CVSS 5.3) — Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-increment…
    CVE-2026-101271 (CVSS 2.1) — OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth…
    CVE-2026-101270 (CVSS 2.1) — Malicious HTML content could be injected into the help texts of various fields with organizer permissions.…
    CVE-2026-101269 (CVSS 2.3) — The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and …
    CVE-2026-101268 (CVSS 1.7) — If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attack…
    CVE-2026-101267 (CVSS 2.7) — A missing permission check allowed low-privileged users with access to an event but without access to the even…
    CVE-2026-101266 (CVSS 1.3) — A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping…
    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High