# CVE-2026-101273: pretix gift card ID enumeration and account credit increase

Source: https://junglewise.ai/threats/cve-2026-101273-some-of-our-api-endpoints-allowed-to-create-order-payments  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-101273 · Severity: info · Published 2026-10-28

pretix is a ticket sales platform used by conference organizers to manage events. The vulnerability allows authenticated users to manipulate API endpoints to access and refund gift cards belonging to other organizers, potentially crediting unauthorized value to those cards. This represents a breach of isolation between separate organizer accounts on the platform.

Technologies: [Pretix](https://junglewise.ai/threats/technologies/pretix-pretix). Vendors: [Pretix](https://junglewise.ai/threats/vendors/pretix).

## Quick answers

**Is CVE-2026-101273 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101273 being exploited in the wild.

**How severe is CVE-2026-101273?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Pretix All versions prior to 2026.8.1, 2026.7.3, and 2026.6.4.

**Is there a fix for CVE-2026-101273?** Yes: fixed in 2026.8.1, 2026.7.3, 2026.6.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101273 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101273?** Check whether you run Pretix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.8.1, 2026.7.3, 2026.6.4

## Technical details

The API endpoints validate gift card references by auto-incremented internal ID without checking ownership against the authenticated user's organizer context, allowing cross-organizer gift card enumeration and manipulation. An attacker with an authenticated account can create payments referencing arbitrary gift cards and then trigger refunds to increase their balance. The vulnerability requires authentication and self-hosted deployments where account creation is possible.

## Affected products

- pretix pretix All versions prior to 2026.8.1, 2026.7.3, and 2026.6.4

## Timeline

- 2026-10-28: disclosed: Security advisory published

## References

- [https://pypi.python.org/](https://pypi.python.org/)
- [https://pretix.eu/about/en/blog/20261028-release-2026-8-1/](https://pretix.eu/about/en/blog/20261028-release-2026-8-1/)

## Related threats

- [pretix missing permission check in ticket layout API](https://junglewise.ai/threats/cve-2026-125744-our-api-endpoint-for-changing-ticket-layouts-did-not-properly)
- [Pretix payment status validation bypass in Adyen integration](https://junglewise.ai/threats/cve-2026-101275-our-payment-integration-with-adyen-did-not-properly-validate)
- [pretix improper validation of OpenID Connect response_type in SSO](https://junglewise.ai/threats/cve-2026-101274-when-pretix-is-used-as-the-identity-provider-in-a-single-sign-on)
- [pretix session validation bypass in API-created shredder exports](https://junglewise.ai/threats/cve-2026-101272-the-mechanism-binding-files-generated-during-a-shredding-process)
- [Pretix OAuth access token revocation failure](https://junglewise.ai/threats/cve-2026-101271-oauth-credentials-access-tokens-are-valid-for-the-entirety-of)