Is CVE-2026-101272 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101272 being exploited in the wild.

How severe is CVE-2026-101272?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Pretix All currently supported versions before 2026.8.1, 2026.7.3, 2026.6.3.

Is there a fix for CVE-2026-101272?

Yes: fixed in pretix 2026.8.1, 2026.7.3, 2026.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101272 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-101272?

Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101272: pretix session validation bypass in API-created shredder exports

CVE-2026-101272 · Severity: info · Published 2026-10-28

pretix is an event ticketing platform that manages conference and festival registrations. A flaw in session binding for shredder export files allows the same API token to be reused across different authenticated users, potentially exposing exported data. While the files are temporary and identified by random UUIDs making direct discovery unlikely, this undermines the intended authentication protection.

Technologies: Pretix. Vendors: Pretix.

Quick answers

Is CVE-2026-101272 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101272 being exploited in the wild.
How severe is CVE-2026-101272?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Pretix All currently supported versions before 2026.8.1, 2026.7.3, 2026.6.3.
Is there a fix for CVE-2026-101272?: Yes: fixed in pretix 2026.8.1, 2026.7.3, 2026.6.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101272 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-101272?: Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: pretix 2026.8.1, 2026.7.3, 2026.6.3

Technical details

The session validation mechanism for files generated during the data shredding process does not correctly bind exported files to the authentication method, allowing all token-based API users to share the same session token. The vulnerability exists in API-created shredder exports and affects session isolation. Although files are referenced by unguessable UUIDs and expire after one day, an attacker with knowledge of a valid UUID could access another user's export data if they know the corresponding session token.

Affected products

pretix pretix All currently supported versions before 2026.8.1, 2026.7.3, 2026.6.3

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.