CVE-2026-101267

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101267
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101267.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101267
Published
2026-09-29T11:59:34Z
Modified
2026-10-03T11:45:24Z
Severity
  • 2.7 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U CVSS Calculator
Summary
Revenue information leak
Details

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

Database specific 
{
    "cna_assigner": "rami.io",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101267.json"
}
References

Affected packages

Git / github.com/pretix/pretix

Affected ranges

Type
GIT
Repo
https://github.com/pretix/pretix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bdfe683146859aaeb9b094aacc2058332ae26659
Introduced
fd565ecdb29c55a3e82dc15d94a848d193664caa
Fixed
91d7459ecd6d4e09da20d9ca7f0b5b171378ad9d
Introduced
79dcf60ed2bf22248869659a97e9ccda846ebc58
Fixed
b474664fb82309855d718d88a161095003bbeb22
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.0"
        },
        {
            "fixed": "2026.5.5"
        },
        {
            "introduced": "2026.6.0"
        },
        {
            "fixed": "2026.6.2"
        },
        {
            "introduced": "2026.7.0"
        },
        {
            "fixed": "2026.7.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.0b1
1.0.0b2
Other
s
v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2023.*
v2023.10.0
v2023.6.0
v2023.7.0
v2023.8.0
v2023.9.0
v2024.*
v2024.1.0
v2024.10.0
v2024.11.0
v2024.2.0
v2024.3.0
v2024.4.0
v2024.5.0
v2024.6.0
v2024.7.0
v2024.8.0
v2024.9.0
v2025.*
v2025.1.0
v2025.10.0
v2025.2.0
v2025.3.0
v2025.4.0
v2025.5.0
v2025.6.0
v2025.7.0
v2025.8.0
v2025.9.0
v2026.*
v2026.1.0
v2026.2.0
v2026.3.0
v2026.4.0
v2026.5.0
v2026.5.1
v2026.5.2
v2026.5.3
v2026.5.4
v2026.6.0
v2026.6.1
v2026.7.0
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.11.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.18.0
v3.2.0
v3.3.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0
v4.*
v4.0.0
v4.1.0
v4.10.0
v4.11.0
v4.13.0
v4.14.0
v4.15.0
v4.16.0
v4.17.0
v4.18.0
v4.19.0
v4.2.0
v4.20.0
v4.3.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101267.json"