---
id: CVE-2026-101267
title: >-
  A missing permission check allowed low-privileged users with access to an
  event but without access to the event's orders to extract some specific
  information
summary: >-
  A missing permission check allowed low-privileged users with access to an
  event but without access to the event's orders to extract some specific
  information. This information includes the number of attendees and the total
  revenue.
severity: low
cvss: 2.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U'
cwe:
  - CWE-862
vendor: pretix
product: pretix
affected:
  - pretix >= 0.0 < 2026.5.5
  - pretix >= 2026.6.0 < 2026.6.2
  - pretix >= 2026.7.0 < 2026.7.1
published: '2026-09-29'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T21:28:02.477'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-101267'
references:
  - url: 'https://pretix.eu/about/en/blog/20260929-release-2026-7-1/'
    label: 655498c3-6ec5-4f0b-aea6-853b334d05a6
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-29T14:47:24.731638Z'
cvssSource: cna
ingestedAt: '2026-09-29T12:33:37.304Z'
epss: 0.00239
epssPercentile: 0.14953
---

## Overview

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.