API Payment Vulnerability in Pretix Gift Card Management
CVE-2026-101273

5.3MEDIUM

Key Information:

Vendor

Pretix

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-101273?

An API vulnerability in Pretix allows the creation of order payments referencing gift cards using an unchecked auto-incremented internal ID. This oversight can lead to unauthorized access to gift cards from different organizers, potentially exposing sensitive data. Although the gift card itself is not charged, an attacker could trigger a refund on the payment, effectively increasing the value of the gift card. It's crucial for users to update to the latest version to mitigate this risk.

References

https://pretix.eu/about/en/blog/20261028-release-2026-8-1/
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Romel Lanza
.