CVE-2026-101273mediumCWE-639

CVE-2026-101273: medium-severity vulnerability in pretix

Giftcard enumeration

Published · Updated

Follow this CVE+ Monitor pretix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Affected products
pretix · pretix
Related CVEs — pretix

In the same product, most dangerous first.

CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2026-57532HIGHCVE-2026-57532EPSS 0.4%CVE-2026-57535LOWCVE-2026-57535EPSS 0.4%CVE-2026-101274MEDIUMCVE-2026-101274EPSS 0.4%CVE-2026-13602HIGHSession takeover vulnerabilityEPSS 0.4%CVE-2026-101272LOWIncorrect session validation for API-created shredder exportsEPSS 0.3%