Low severity · published Jun 9, 2026
CVE-2026-11764
Data exposed without proper permission
3.6
CVSS
0.2%
EPSS
No
On KEV
Description
When creating an export of all reusable media, the secrets of connected
gift cards were included in the export even if the user creating the
export does not have permission to view gift cards. This is inconsistent
with the UI and API where only the first letters of the gift card
secret are shown. Therefore, it allows circumventing a permission
boundary.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix · pretix
2024.1.0 before 2026.3.0; 2026.3.0 before 2026.4.0; 2026.4.0 before 2026.5.0; 2026.5.0 before 2026.6.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11764
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11764
pretix.eu
https://pretix.eu/about/en/blog/20260609-release-2026-5-1/
More from pretix
9.8
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation
8.8
CVE-2026-57532
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
7.7
CVE-2026-13602
Session takeover vulnerability
6.5
CVE-2026-2452
Unsafe variable evaluation in email templates
6.5
CVE-2026-2451
Unsafe variable evaluation in email templates