EUVD-2026-49753
GHSA-2gm5-4hq3-g753
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated user (PR:L); the 'well-timed request' race makes AC:H; only limited event-config integrity impact, no confidentiality or availability effect.
Primary rating from Vendor (655498c3-6ec5-4f0b-aea6-853b334d05a6).
CVSS VectorVendor: 655498c3-6ec5-4f0b-aea6-853b334d05a6
Lifecycle Timeline
2DescriptionCVE.org
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.
AnalysisAI
Authenticated users of pretix can abuse the 'quick setup' view shown right after an event is created to alter configuration on events they do not have permission to manage - creating products and quotas, setting bank-transfer configuration, or linking a Stripe account. Exploitation requires a valid logged-in account (CVSS PR:L) and a well-timed, race-condition-style request (AT:P) to hit the configuration actions before the per-event permission check applies, which substantially limits reliability; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confines impact to integrity of event configuration with no confidentiality or availability loss. All signals - a 2.3 CVSS 4.0 base score, EPSS of 0.21% (11th percentile), SSVC 'Exploitation: none / Automatable: no / Technical Impact: partial', and the absence of KEV listing or public exploit code - converge on low real-world priority, and no public exploit has been identified at time of analysis. Fixed versions are available from the vendor.
Technical ContextAI
pretix is an open-source, Django-based event ticketing and registration platform; the affected component is the post-creation 'quick setup' wizard that walks a user through the most critical event configuration steps immediately after an event is created. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the quick setup view acts on an event identifier supplied through the request rather than re-validating that the requesting account holds change-configuration rights for that specific event, so the view's handler trusts a user-controlled key instead of enforcing an object-level authorization check. In practice this is an access-control gap rather than a memory-safety or injection defect, and it only reaches a privileged state because the wizard's actions (creating products and quotas, writing bank-transfer settings, wiring an OAuth-style Stripe connection) are otherwise reserved for event administrators. The timing dependency flagged by the CVSS 4.0 AT:P metric and reflected in the independent assessment's AC:H rating indicates the window is narrow and the malicious request must be sequenced against the legitimate creation flow, which is why SSVC scores the bug as non-automatable with only partial technical impact. No CPE strings were supplied in the intelligence feed; affected version ranges come from EUVD (pretix 2026.6.0 < 2026.6.1, pretix 2026.5.0 < 2026.5.4, and pretix 0 < 2026.4.6), indicating the flaw spans at least three maintained release branches.
RemediationAI
Upgrade to a vendor-fixed release: pretix 2026.6.1 for the 2026.6.x line, pretix 2026.5.4 for the 2026.5.x line, or pretix 2026.4.6 for the 2026.4.x line - the vendor has released patches covering all three branches (referenced at https://pretix.eu/about/en/blog/20260728-release-2026-6-1/ and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-18028). Because the flaw requires an authenticated account (PR:L) plus a well-timed request against the post-creation quick setup view, the practical compensating controls are privilege-side rather than network-side: tighten who is permitted to create events by restricting the event-creation permission to a small, trusted organizer group, since removing self-service event creation eliminates the attacker's foothold entirely, at the cost of increased administrative overhead and slower onboarding for legitimate organizers. If event creation cannot be restricted, monitor pretix activity and audit logs for products, quotas, bank-transfer settings, or Stripe connections being created within seconds of an event's creation by an account that is not an event administrator, and alert on mismatches between the acting account and the event's admin list; this is detection rather than prevention and depends on log retention and review capacity. Note that blocking network ports or the Stripe integration would break legitimate payment flows and is not a proportionate mitigation for a low-EPSS, non-automatable integrity issue. No public exploit code has been identified at time of analysis, and CISA SSVC recorded exploitation as 'none', so emergency out-of-band patching is not indicated; schedule the upgrade in the next routine maintenance window.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today