CVE-2026-11764

Data exposed without proper permission

State: Published
Severity: 3.6 Low
Published: Jun 9, 2026
Updated: Jun 9, 2026
Reserved: Jun 9, 2026

Description

When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.

Scores

CVSS	Score	Vector	Source
4.0	3.6 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U	rami.io

Weaknesses

CWE-280 Improper handling of insufficient permissions or privileges

Affected Products

Product	Versions
pretixpretix	2024.1.0 to before 2026.3.0Affected 2026.3.0 to before 2026.4.0Affectedfrom 2026.3.3Not affected 2026.4.0 to before 2026.5.0Affectedfrom 2026.4.3Not affected 2026.5.0 to before 2026.6.0Affectedfrom 2026.5.1Not affected

References

https://pretix.eu/about/en/blog/20260609-release-2026-5-1/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.