All vulnerabilities
CVE-2026-101269

pretix: Incorrect session validation for API-uploaded files

pretix pretix
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.5.5Also 2026.6.2, 2026.7.1CVE List
Published29 Sep 2026Updated 29 Sep 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

Text from CVE List

Affected versions 3

  • pretixaffected: 0.0 before 2026.5.5CVE List
  • pretixaffected: 2026.6.0 before 2026.6.2CVE List
  • pretixaffected: 2026.7.0 before 2026.7.1CVE List

References 1