What’s Vulnerable › Vulnerabilities
CVE-2026-11764: Data exposed without proper permission
- Severity: low (CVSS 3.6 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-09 · updated 2026-07-23
- Weakness: CWE-280
Description
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.
Affected products
- pretix: from 2024.1.0 before 2026.3.0; from 2026.3.0 before 2026.4.0; from 2026.4.0 before 2026.5.0; from 2026.5.0 before 2026.6.0 — fixed in 2026.3.0, 2026.4.0, 2026.5.0, 2026.6.0
How to fix
Upgrade to a fixed version: pretix 2026.3.0, 2026.4.0, 2026.5.0, 2026.6.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-11764 or the next vulnerability affects your stack