Read the docs
TI-2026-81924 Aliases CVE-2026-101272GHSA-38jm-3ffc-942j

pretix shredder exports bind to the wrong session token for API users

Priority LOW 12Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

pretix before 2026.6.4, from 2026.7.0 before 2026.7.3 and from 2026.8.0 before 2026.8.1 are affected. The mechanism that binds files generated during shredding to the authentication method does not work, so all token-based API users share the same session token. A remote attacker with low privileges can reach these exports, but random UUIDs and a one-day lifetime make the risk low.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.

Why it matters now

EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2026.6.4, 2026.7.3, 2026.8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pretixpretixbefore 2026.6.4; 2026.7.0 to before 2026.7.3; 2026.8.0 to before 2026.8.12026.6.4, 2026.7.3, 2026.8.1Patch availableCNA
  • pretix Vendorpretix Affected before 2026.6.4; 2026.7.0 to before 2026.7.3; 2026.8.0 to before 2026.8.1 Fixed in 2026.6.4, 2026.7.3, 2026.8.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*——pretix
  • cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions — — ·pretix

Remediation

Upgrade pretix to 2026.6.4, 2026.7.3 or 2026.8.1, depending on the release line in use.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA pretix (pretix) Fixed in 2026.6.4, 2026.7.3, 2026.8.1

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-101272
  2. 2026-10-28 Alias added: GHSA-38jm-3ffc-942j

References

Advisory 1

  • TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
  • TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
  • TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
  • TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences