Auth bypass in Pretix Gmbh
CVE-2026-18028
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration…
Vulnerability class: IDOR (Insecure Direct Object Reference)
Affected products
- Pretix Gmbh — versions 0, 2026.5.0, 2026.6.0
Weakness classification (CWE)
References
- 655498c3-6ec5-4f0b-aea6-853b334d05a6 (vendor-advisory)