CVE-2026-101272 Details
Description
The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.
A vulnerability exists in pretix that affects the session validation for files generated during a shredding process via the API. The same session token is improperly used for all token-based API users, leading to a flaw in the authentication mechanism. This issue, similar to one previously addressed in version 2026.7.1, was overlooked during the fix. Although the files are accessible through randomly generated UUIDs and have a lifespan of one day, which minimizes risk, the vulnerability renders the intended protection mechanism ineffective.
Users are advised to update to pretix versions 2026.8.1, 2026.7.3, or 2026.6.4, all of which include the necessary fix. For those using pretix Hosted, the vulnerability has already been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://pretix.eu/about/en/blog/20261028-release-2026-8-1/ | rami.io | AdvisoryBundleRemedyVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| pretix | >= 2026, < 2026.8.1 >= 2026.7, < 2026.7.3 >= 2026.6, < 2026.6.4 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | New CVE Received | rami.io |