Is CVE-2026-101273 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101273 being exploited in the wild.

How severe is CVE-2026-101273?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Pretix All versions prior to 2026.8.1, 2026.7.3, and 2026.6.4.

Is there a fix for CVE-2026-101273?

Yes: fixed in 2026.8.1, 2026.7.3, 2026.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101273 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-101273?

Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101273: pretix gift card ID enumeration and account credit increase

CVE-2026-101273 · Severity: info · Published 2026-10-28

pretix is a ticket sales platform used by conference organizers to manage events. The vulnerability allows authenticated users to manipulate API endpoints to access and refund gift cards belonging to other organizers, potentially crediting unauthorized value to those cards. This represents a breach of isolation between separate organizer accounts on the platform.

Technologies: Pretix. Vendors: Pretix.

Quick answers

Is CVE-2026-101273 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101273 being exploited in the wild.
How severe is CVE-2026-101273?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Pretix All versions prior to 2026.8.1, 2026.7.3, and 2026.6.4.
Is there a fix for CVE-2026-101273?: Yes: fixed in 2026.8.1, 2026.7.3, 2026.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101273 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-101273?: Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.8.1, 2026.7.3, 2026.6.4

Technical details

The API endpoints validate gift card references by auto-incremented internal ID without checking ownership against the authenticated user's organizer context, allowing cross-organizer gift card enumeration and manipulation. An attacker with an authenticated account can create payments referencing arbitrary gift cards and then trigger refunds to increase their balance. The vulnerability requires authentication and self-hosted deployments where account creation is possible.

Affected products

pretix pretix All versions prior to 2026.8.1, 2026.7.3, and 2026.6.4

Timeline

2026-10-28: disclosed: Security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.