CVE-2026-101267 in pretix
Summary
by MITRE • 09/29/2026
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability described constitutes a classic Broken Access Control flaw, specifically falling under CWE-284: Improper Access Control. In this scenario, an application fails to enforce proper authorization checks when processing requests related to event data that are coupled with order information. The core technical issue lies in the server-side logic which retrieves aggregated metrics such as attendee counts and total revenue without verifying whether the requesting user possesses sufficient privileges to view associated financial or operational details like orders. This oversight allows a low-privileged user, who may have legitimate read access to basic event metadata but lacks permission to view specific order records, to bypass these restrictions by exploiting the endpoint that serves combined data. The application incorrectly assumes that if a user can see an event, they should be able to see all aggregated statistics related to it, ignoring the principle of least privilege which dictates that users should only have access to the minimum level of information necessary for their role.
From an operational impact perspective, this vulnerability leads to sensitive data exposure and potential business intelligence leakage. The disclosure of total revenue provides competitors or malicious actors with insights into the financial performance of specific events, potentially revealing pricing strategies, ticket sales velocity, and overall profitability margins. Similarly, while attendee counts might seem benign, they can be used for social engineering attacks, reputation damage, or to gauge the scale of an organization's operations. In regulated industries where data privacy is paramount, such as healthcare or finance, exposing even aggregated financial data without proper authorization could lead to compliance violations with standards like GDPR or HIPAA if personal identifiers are inadvertently linked through other means. The attack vector typically involves a low-privileged user making direct API calls or manipulating HTTP parameters to request event details that include the restricted fields, effectively bypassing UI-level restrictions that might hide these elements from standard users but fail to enforce them at the backend logic level.
This type of vulnerability is frequently mapped to MITRE ATT&CK technique T1078: Valid Accounts, as it relies on legitimate credentials with limited privileges rather than exploiting a software bug in authentication mechanisms. It also aligns with CWE-639: Authorization Bypass Through User-Controlled Key if the event identifier or order reference was manipulated, though here the primary failure is simply missing permission checks for specific data fields within an otherwise authorized request. To mitigate this issue, developers must implement robust server-side authorization checks that validate user permissions against every piece of sensitive data being returned by an API endpoint. This involves ensuring that access control lists are checked not just at the resource level but also at the attribute or field level where necessary. Additionally, implementing a centralized authorization service can help enforce consistent policies across all endpoints. Regular security testing, including automated penetration tests focused on broken access controls and manual code reviews to identify missing permission checks in data retrieval logic, is essential for preventing such vulnerabilities from reaching production environments.