Live › vulnerability › CVE-2026-101273
Go to dashboardSome API endpoints accepted a gift card's internal auto-incremented ID when creating an order payment, without checking that the card belonged to the same organizer. An attacker could use cards from other organizers to learn their secret and then raise the value of a card through a refund.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.
This page as .md · .json · in your agent: get_signal("CVE-2026-101273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.