Read the docs
TI-2026-65166 Aliases CVE-2026-101268GHSA-37hj-f7xh-f4vx

Customer session fixation

Priority LOW 9CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-384.

Summary

If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2026.5.5, 2026.6.2, 2026.7.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pretixpretix0.0 to before 2026.5.5; 2026.6.0 to before 2026.6.2; 2026.7.0 to before 2026.7.12026.5.5, 2026.6.2, 2026.7.1Patch availableCNA
  • pretix Vendorpretix Affected 0.0 to before 2026.5.5; 2026.6.0 to before 2026.6.2; 2026.7.0 to before 2026.7.1 Fixed in 2026.5.5, 2026.6.2, 2026.7.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*——pretix
  • cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions — — ·pretix

Remediation

  • Fix · CNA pretix (pretix) Fixed in 2026.5.5, 2026.6.2, 2026.7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    pretix — pretix.eu/about/en/blog/20260929-release-2026-7-1

    6 records Highest priority Priority LOW 6 LOW

    Other records, highest priority first

    • TI-2026-65165 Revenue information leakPriority LOW 19
    • TI-2026-65167 Incorrect session validation for API-uploaded filesPriority LOW 11
    • TI-2026-65169 OAuth credentials not disabled when application is disabledPriority LOW 10
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101268
  2. 2026-10-03 Alias added: GHSA-37hj-f7xh-f4vx

References

Advisory 1

  • TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
  • TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
  • TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
  • TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences