pretix CVE-2026-101268

Exploitation requires a specific non-default deployment: the event must be served on a DIFFERENT domain than the organizer page - the vendor states the attack only works under this cross-domain configuration. It further requires victim user interaction (the victim must follow an attacker-crafted link) and the victim failing to notice they have been logged into an unfamiliar (attacker's) customer account before completing an order. The attacker needs no authentication or prior privileges (PR:N), but success depends on social engineering and the victim actually placing an order in the hijacked session, which limits real-world reliability.

This is a genuinely low-risk issue, and the signals are consistent for once. The vendor's CVSS 4.0 vector scores 1.7 with high attack complexity (AC:H) and exploit maturity E:U (unproven), there is no CISA KEV listing, no public POC, and no EPSS supplied. The described impact is minor - a login-CSRF / session-fixation style flaw where a victim is silently logged into the ATTACKER's account, causing the victim's subsequent order details to be captured by the attacker (a confidentiality/integrity leak of order data, VC:L/VI:L, no availability impact). Exploitation is further gated by a non-default deployment condition (the event must be served on a different domain than the organizer page) and by convincing the victim to click a crafted link and not notice they are logged into a foreign account. One inconsistency worth noting: the vendor set UI:N despite the description explicitly requiring the victim to follow a crafted link, which is at minimum passive user interaction (UI:P) - this makes the published vector slightly optimistic on attacker convenience but does not change the low overall severity. Bottom line: not a priority; treat as a routine patch item.

An attacker crafts a link that, when followed by a victim on a pretix instance where the event lives on a different domain than the organizer page, silently authenticates the victim into the attacker-controlled customer account. If the victim proceeds to place an order without noticing they are in someone else's account, their order details (personal/purchase data) are written into the attacker's account for the attacker to read. No public exploit code is identified and the vendor marks exploit maturity as unproven (E:U).