CVE-2026-101273
Giftcard enumeration
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
| Vendor | pretix |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for pretix
Be the first to know when new unknown vulnerabilities affecting pretix are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
pretix /
0 < 2026.6.4 2026.7.0 < 2026.7.3 2026.8.0 < 2026.8.1
References
Credits
Romel Lanza