Vulnerability · Published Sep 29, 2026 · Assigned by rami.io

CVE-2026-101269Incorrect session validation for API-uploaded files

Low 2.3

In plain English

A low-severity improper authentication in pretix from pretix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

Affected products (as reported)

Vendor	Product	Versions
pretix	pretix	0.0 – before 2026.5.52026.6.0 – before 2026.6.22026.7.0 – before 2026.7.1

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ vendor-advisory