All vulnerabilities
CVE-2026-101273

Giftcard enumeration

pretix
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2026.6.4Also 2026.7.3, 2026.8.1CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

Text from CVE List

Affected versions 3

  • pretixaffected: all versions before 2026.6.4CVE List
  • pretixaffected: 2026.7.0 before 2026.7.3CVE List
  • pretixaffected: 2026.8.0 before 2026.8.1CVE List

References 1