CVE-2026-101272Low· 2.3▾ SunlitThe mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but wa…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.
pretix < 2026.6.4pretix >= 2026.7.0 < 2026.7.3pretix >= 2026.8.0 < 2026.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101273Medium· 5.3Giftcard enumeration
CVE-2026-101274Medium· 6.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…
CVE-2026-101267Low· 2.7A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information
CVE-2026-101268Low· 1.7If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account
CVE-2026-101269Low· 2.3The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users
CVE-2026-101270Low· 2.1Malicious HTML content could be injected into the help texts of various fields with organizer permissions.