CVE-2026-101267

Revenue information leak

Low2.7EPSS 0.24%

Published: 29 Sept 2026
Updated: 29 Sept 2026
Reserved: 28 Sept 2026
Assigned by: rami.io

Description

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

Scores

CVSS scores of CVE-2026-101267, by who scored it
Scored by	CVSS	Score	Vector
rami.ioCNA (assigner)	4.0	Low2.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U
NVDNVD · Deferred	4.0	Low2.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.24% · top 85% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.7.

Weakness

CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

pretix · pretix
- affected 0.0 – < 2026.5.5
- affected 2026.6.0 – < 2026.6.2
- affected 2026.7.0 – < 2026.7.1

References (1)

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-101267](https://trackcve.app/badge/CVE-2026-101267.svg)](https://trackcve.app/cve/CVE-2026-101267)

Record last updated 29 Sept 2026, 14:47 UTC.