Search

Find a vulnerability

Search criteria

    2 vulnerabilities

    CVE-2026-125744 (GCVE-0-2026-125744)

    Vulnerability from cvelistv5 – Published: 2026-11-10 13:00 – Updated: 2026-11-10 13:00
    VLAI
    Title
    Missing permission check in ticket layout API
    Summary
    Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
    Severity
    1.2 (Low)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
    Assigner
    pretix CNA
    References
    Impacted products
    Vendor Product Version
    pretix Affected: 0 , < 2026.7.4 (python)
    Affected: 2026.8.0 , < 2026.8.2 (python)
    Affected: 2026.9.0 , < 2026.9.1 (python)
    Credits
    Immanuel Tikhonov
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "pretix",
          "repo": "https://github.com/pretix/pretix",
          "vendor": "pretix",
          "versions": [
            {
              "lessThan": "2026.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            },
            {
              "lessThan": "2026.8.2",
              "status": "affected",
              "version": "2026.8.0",
              "versionType": "python"
            },
            {
              "lessThan": "2026.9.1",
              "status": "affected",
              "version": "2026.9.0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Immanuel Tikhonov"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event\u0027s ticket layout."
            }
          ],
          "value": "Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event\u0027s ticket layout."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 1.2,
            "baseSeverity": "LOW",
            "exploitMaturity": "UNREPORTED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T13:00:36.147Z",
        "orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "shortName": "pretix"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing permission check in ticket layout API",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
    "assignerShortName": "pretix",
    "cveId": "CVE-2026-125744",
    "datePublished": "2026-11-10T13:00:36.147Z",
    "dateReserved": "2026-11-10T12:13:22.604Z",
    "dateUpdated": "2026-11-10T13:00:36.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-101275 (GCVE-0-2026-101275)

    Vulnerability from cvelistv5 – Published: 2026-11-10 12:00 – Updated: 2026-11-10 12:00
    VLAI
    Title
    Insufficient validation of payment status in pretix-adyen
    Summary
    Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
    Severity
    6.3 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
    Assigner
    pretix CNA
    References
    Impacted products
    Vendor Product Version
    pretix pretix-adyen Affected: 0 , < 1.5.4 (python)
    		Create a notification for this product.
    Credits
    Digant Prajapati
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.python.org",
          "defaultStatus": "unaffected",
          "packageName": "pretix-adyen",
          "product": "pretix-adyen",
          "repo": "https://github.com/pretix/pretix-adyen",
          "vendor": "pretix",
          "versions": [
            {
              "lessThan": "1.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Digant Prajapati"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment."
            }
          ],
          "value": "Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T12:00:19.011Z",
        "orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "shortName": "pretix"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://pretix.eu/about/en/blog/20261110-adyen/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient validation of payment status in pretix-adyen",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
    "assignerShortName": "pretix",
    "cveId": "CVE-2026-101275",
    "datePublished": "2026-11-10T12:00:19.011Z",
    "dateReserved": "2026-09-28T11:48:56.321Z",
    "dateUpdated": "2026-11-10T12:00:19.011Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}