CVE-2026-101273medium

CVE-2026-101273: falha de média gravidade em pretix

Giftcard enumeration

Publicada em

Seguir esta CVE+ Monitorar pretix

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Produtos afetados
pretix · pretix
CVEs relacionadas — pretix

No mesmo produto, das mais perigosas para as menos.

CVE-2026-13225MEDIUMStored XSS in ticket confirmation pageEPSS 0.4%CVE-2026-57532HIGHCVE-2026-57532EPSS 0.4%CVE-2026-57535LOWCVE-2026-57535EPSS 0.4%CVE-2026-101274MEDIUMCVE-2026-101274EPSS 0.4%CVE-2026-13602HIGHSession takeover vulnerabilityEPSS 0.4%CVE-2026-101272LOWIncorrect session validation for API-created shredder exportsEPSS 0.3%