CVE Feed

    Dashboard / CVE / CVE-2026-18028

    CVE-2026-18028

    The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.

    Published:Jul 28, 2026
    Last Modified:Jul 28, 2026
    EPS:Jul 28, 2026
    EPSS Score:
    CVSS Score:2.3

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…
    CVE-2026-57532 (CVSS 8.8) — Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed whe…
    CVE-2026-57533 (CVSS 2.1) — Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occ…
    CVE-2026-57535 (CVSS 2.1) — Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. I…
    CVE-2026-13225 (CVSS 5.3) — Malicious HTML content could be injected into the email address of an order, which pretix showed without sani…
    CVE-2026-11764 (CVSS 3.6) — When creating an export of all reusable media, the secrets of connected gift cards were included in the expor…
    CVE-2026-9712 (CVSS 3.8) — When creating an export through the pretix API, API clients are returned an UUID value for their export job (…
    CVE-2026-5600 (CVSS 5.5) — A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific eve…
    CVE-2026-2452 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…
    CVE-2026-2451 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High