CVE-2026-101269: Pretix

Low severity, CVSS 2.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

Affected products

• Pretix Pretix: from 0.0, before 2026.5.5 (fixed in 2026.5.5); from 2026.6.0, before 2026.6.2 (fixed in 2026.6.2); from 2026.7.0, before 2026.7.1 (fixed in 2026.7.1)

Published 2026-09-29. Last modified 2026-09-29.