CVE-2026-101267CWE-862broken-access-control

CVE-2026-101267

published September 29, 2026

CVSS
2.7
EPSS
0%
Percentile
14.2
In the wild
Unconfirmed
What it is

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

The record
Technical detail
CVSS
2.7 · NONE
CVSS v4.0
2.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U
EPSS
0.00239 · 14.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-29T17:17Z
References (1)
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ · 655498c3-6ec5-4f0b-aea6-853b334d05a6
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 11:59Z
    Revenue information leak
    cvelistv5