CVE-2026-101273mediumCWE-639

CVE-2026-101273: fallo de gravedad media en pretix

Giftcard enumeration

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pretix

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Productos afectados
pretix · pretix
CVEs relacionadas — pretix

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2026-57532HIGHCVE-2026-57532EPSS 0.4%CVE-2026-57535LOWCVE-2026-57535EPSS 0.4%CVE-2026-101274MEDIUMCVE-2026-101274EPSS 0.4%CVE-2026-13602HIGHSession takeover vulnerabilityEPSS 0.4%CVE-2026-101272LOWIncorrect session validation for API-created shredder exportsEPSS 0.3%