CVE-2026-101269CWE-287

CVE-2026-101269

published September 29, 2026

CVSS
2.3
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

The record
Technical detail
CVSS
2.3 · NONE
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-09-29T17:17Z
References (1)
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ · 655498c3-6ec5-4f0b-aea6-853b334d05a6
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 12:01Z
    Incorrect session validation for API-uploaded files
    cvelistv5