Low severity · published Sep 29, 2026
CVE-2026-101267
Revenue information leak
2.7
CVSS
0.2%
EPSS
No
On KEV
Description
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix · pretix
0.0 before 2026.5.5; 2026.6.0 before 2026.6.2; 2026.7.0 before 2026.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101267
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101267
vendor-advisory
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/
More from pretix
9.8
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation
8.8
CVE-2026-57532
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
7.7
CVE-2026-13602
Session takeover vulnerability
6.5
CVE-2026-2452
Unsafe variable evaluation in email templates
6.5
CVE-2026-2451
Unsafe variable evaluation in email templates