CVE-2026-101272— Incorrect session validation for API-created shredder exports

Quick assessment

Affected

pretix

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在碎纸（shredding）过程中，将生成的绑定文件与认证机制进行关联的机制存在缺陷，导致所有基于令牌的 API 用户均使用同一个会话令牌。该问题与 2026.7.1 版本中已修复的某个问题类似，但在实施修复时被遗漏。由于相关文件通过随机生成的 UUID 进行引用，且仅保留一天，因此实际风险极低；但该缺陷使得新增的保护机制失效。作为修复的一部分，我们同时加强了一些其他相关代码区域的安全性加固措施。

CVSS 2.3 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1538 · Cloud Service Dashboard

Affected Version Matrix 3

Vendor	Product	Version Range	Status
pretix	None	`< 2026.6.4`	affected
		`2026.7.0< 2026.7.3`	affected
		`2026.8.0< 2026.8.1`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Incorrect session validation for API-created shredder exports

Source: CVE Program / CVE List V5

Vulnerability Description

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pretix	-	0 ~ 2026.6.4	-

II. Public POCs for CVE-2026-101272

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-101272

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-101272 (1)

🔗 Security release 2026.8.1 of pretix – pretix – Reinventing ticket sales for conferences, festivals, exhibitions, ... vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-101272

Same Patch Batch · pretix · 2026-10-28 · 3 CVEs total

CVE-2026-101274	6.9 MEDIUM	Pretix SSO 配置错误导致授权响应类型验证漏洞
CVE-2026-101273	5.3 MEDIUM	Giftcard enumeration

IV. Related Vulnerabilities

Same vendor: pretix