CVE-2026-11764

When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.

CVSS

No CVSS.

References

Link	Resource
https://pretix.eu/about/en/blog/20260609-release-2026-5-1/

Configurations

No configuration.

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Al crear una exportación de todos los medios reutilizables, los secretos de las tarjetas de regalo conectadas se incluyeron en la exportación incluso si el usuario que crea la exportación no tiene permiso para ver las tarjetas de regalo. Esto es inconsistente con la interfaz de usuario (UI) y la API, donde solo se muestran las primeras letras del secreto de la tarjeta de regalo. Por lo tanto, permite eludir un límite de permisos.

09 Jun 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 13:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-11764

Mitre link : CVE-2026-11764

CVE.ORG link : CVE-2026-11764

JSON object : View

Products Affected

No product.

CWE

CWE-280

Improper Handling of Insufficient Permissions or Privileges

{"id": "CVE-2026-11764", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11764", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T13:49:30.786909Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 3.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "affectedData": [{"repo": "https://github.com/pretix/pretix", "vendor": "pretix", "product": "pretix", "versions": [{"status": "affected", "version": "2024.1.0", "lessThan": "2026.3.0", "versionType": "python"}, {"status": "affected", "changes": [{"at": "2026.3.3", "status": "unaffected"}], "version": "2026.3.0", "lessThan": "2026.4.0", "versionType": "python"}, {"status": "affected", "changes": [{"at": "2026.4.3", "status": "unaffected"}], "version": "2026.4.0", "lessThan": "2026.5.0", "versionType": "python"}, {"status": "affected", "changes": [{"at": "2026.5.1", "status": "unaffected"}], "version": "2026.5.0", "lessThan": "2026.6.0", "versionType": "python"}], "packageName": "pretix", "collectionURL": "https://pypi.org/", "defaultStatus": "unaffected"}]}], "published": "2026-06-09T13:16:35.533", "references": [{"url": "https://pretix.eu/about/en/blog/20260609-release-2026-5-1/", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "description": [{"lang": "en", "value": "CWE-280"}]}], "descriptions": [{"lang": "en", "value": "When creating an export of all reusable media, the secrets of connected \ngift cards were included in the export even if the user creating the \nexport does not have permission to view gift cards. This is inconsistent\n with the UI and API where only the first letters of the gift card \nsecret are shown. Therefore, it allows circumventing a permission \nboundary."}, {"lang": "es", "value": "Al crear una exportaci\u00f3n de todos los medios reutilizables, los secretos de las tarjetas de regalo conectadas se incluyeron en la exportaci\u00f3n incluso si el usuario que crea la exportaci\u00f3n no tiene permiso para ver las tarjetas de regalo. Esto es inconsistente con la interfaz de usuario (UI) y la API, donde solo se muestran las primeras letras del secreto de la tarjeta de regalo. Por lo tanto, permite eludir un l\u00edmite de permisos."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}