CVE-2026-18028

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18028
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18028.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18028
Published
2026-07-28T10:39:48.208Z
Modified
2026-08-12T03:51:39.227571472Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Missing authorization check in event quick setup view
Details

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.

Database specific 
{
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18028.json",
    "cna_assigner": "rami.io"
}
References

Affected packages

Git / github.com/pretix/pretix

Affected ranges

Type
GIT
Repo
https://github.com/pretix/pretix
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6d7b1baf3debff7778f51a08c8cabbad6f33c959
Introduced
dfd388ddebce33ee64d5b201f8ac8a3476192caa
Fixed
d6d400b5c48f73cd735bbdc8a0ad901d020c362b
Introduced
fd565ecdb29c55a3e82dc15d94a848d193664caa
Fixed
2bd0a341d64383456bc78c18c636b4491cfe8945
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2026.4.6"
        },
        {
            "introduced": "2026.5.0"
        },
        {
            "fixed": "2026.5.4"
        },
        {
            "introduced": "2026.6.0"
        },
        {
            "fixed": "2026.6.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.0b1
1.0.0b2
Other
s
v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2023.*
v2023.10.0
v2023.6.0
v2023.7.0
v2023.8.0
v2023.9.0
v2024.*
v2024.1.0
v2024.10.0
v2024.11.0
v2024.2.0
v2024.3.0
v2024.4.0
v2024.5.0
v2024.6.0
v2024.7.0
v2024.8.0
v2024.9.0
v2025.*
v2025.1.0
v2025.10.0
v2025.2.0
v2025.3.0
v2025.4.0
v2025.5.0
v2025.6.0
v2025.7.0
v2025.8.0
v2025.9.0
v2026.*
v2026.1.0
v2026.2.0
v2026.3.0
v2026.4.0
v2026.4.1
v2026.4.2
v2026.4.3
v2026.4.4
v2026.4.5
v2026.5.0
v2026.5.1
v2026.5.2
v2026.5.3
v2026.6.0
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.11.0
v3.13.0
v3.14.0
v3.15.0
v3.16.0
v3.17.0
v3.18.0
v3.2.0
v3.3.0
v3.4.0
v3.5.0
v3.6.0
v3.7.0
v3.8.0
v3.9.0
v4.*
v4.0.0
v4.1.0
v4.10.0
v4.11.0
v4.13.0
v4.14.0
v4.15.0
v4.16.0
v4.17.0
v4.18.0
v4.19.0
v4.2.0
v4.20.0
v4.3.0
v4.5.0
v4.6.0
v4.7.0
v4.8.0
v4.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18028.json"