CVE-2026-101267
LOW
2,7
Source: 655498c3-6ec5-4f0b-aea6-853b334d05a6
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/