CVE-2026-101267
Revenue information leak
- State
- Published
- Severity
- 2.7 Low
- Published
- Sep 29, 2026
- Updated
- Sep 29, 2026
- Reserved
- Sep 28, 2026
Description
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.7 Low | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U | rami.io |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
pretixpretix |
|
References
- https://pretix.eu/about/en/blog/20260929-release-2026-7-1/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.