CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.

CVSS

No CVSS.

References

Link	Resource
https://pretix.eu/about/en/blog/20260728-release-2026-6-1/

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) La vista de ’configuración rápida’ presentada a los usuarios después de que crean un evento por primera vez permite configurar las partes más críticas de un evento en solo unos pocos clics. Esta vista no verificaba correctamente que el usuario tuviera permiso para cambiar la configuración para el evento dado. Un atacante podría usar una solicitud bien programada para crear productos, cuotas, establecer la configuración de transferencia bancaria o conectar una cuenta de Stripe a un evento al que no tienen acceso.

Information

Published : 2026-07-28 11:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-18028

Mitre link : CVE-2026-18028

CVE.ORG link : CVE-2026-18028

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-18028", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18028", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T12:38:05.542080Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "affectedData": [{"repo": "https://github.com/pretix/pretix", "vendor": "pretix GmbH", "product": "pretix", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.4.6", "versionType": "python"}, {"status": "affected", "version": "2026.5.0", "lessThan": "2026.5.4", "versionType": "python"}, {"status": "affected", "version": "2026.6.0", "lessThan": "2026.6.1", "versionType": "q"}], "packageName": "pretix", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-07-28T11:17:03.530", "references": [{"url": "https://pretix.eu/about/en/blog/20260728-release-2026-6-1/", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The \"quick setup\" view presented to users after they first create an \nevent allows to set up the most critical parts of an event in just a few\n clicks. This view did not properly check that the user has permission \nto change configuration for the given event. An attacker could use a \nwell-timed request to create products, quotas, set bank transfer \nconfiguration, or connect a stripe account to an event they do not have \naccess to."}, {"lang": "es", "value": "La vista de \u2019configuraci\u00f3n r\u00e1pida\u2019 presentada a los usuarios despu\u00e9s de que crean un evento por primera vez permite configurar las partes m\u00e1s cr\u00edticas de un evento en solo unos pocos clics. Esta vista no verificaba correctamente que el usuario tuviera permiso para cambiar la configuraci\u00f3n para el evento dado. Un atacante podr\u00eda usar una solicitud bien programada para crear productos, cuotas, establecer la configuraci\u00f3n de transferencia bancaria o conectar una cuenta de Stripe a un evento al que no tienen acceso."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}