CVE-2026-101273
Giftcard enumeration
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 28, 2026
- Updated
- Oct 28, 2026
- Reserved
- Sep 28, 2026
Description
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | pretix |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
pretixpretix |
|
References
- https://pretix.eu/about/en/blog/20261028-release-2026-8-1/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.