What’s Vulnerable › Vulnerabilities
CVE-2026-101267: Revenue information leak
- Severity: low (CVSS 2.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-29 · updated 2026-09-29
- Weakness: CWE-862
Description
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
Affected products
- pretix: before 2026.5.5; from 2026.6.0 before 2026.6.2; from 2026.7.0 before 2026.7.1 — fixed in 2026.5.5, 2026.6.2, 2026.7.1
How to fix
Upgrade to a fixed version: pretix 2026.5.5, 2026.6.2, 2026.7.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-101267 or the next vulnerability affects your stack