{"id":"CVE-2026-101273","kind":"vulnerability","aliases":["CVE-2026-101273"],"related":[],"title":"Pretix: gift card IDs let attackers read other organizers' gift card secrets","description":"Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.","summary":"Some API endpoints accepted a gift card's internal auto-incremented ID when creating an order payment, without checking that the card belonged to the same organizer. An attacker could use cards from other organizers to learn their secret and then raise the value of a card through a refund.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gift-cards","package","pretix","self-hosted","ticketing"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:38+00:00","updated_at":"2026-10-28T11:33:38+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-28T11:33:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Pretix: gift card IDs let attackers read other organizers' gift card secrets","impact":"medium","summary":"Some API endpoints accepted a gift card's internal auto-incremented ID when creating an order payment, without checking that the card belonged to the same organizer. An attacker could use cards from other organizers to learn their secret and then raise the value of a card through a refund.","category":"package","nicknames":[],"who_cares":["pretix","self-hosted","gift-cards","ticketing"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker reads other organizers' gift card secrets and inflates card value","analyst_note":"Sources do not name the affected product or fixed versions; check the NVD entry and the vendor advisory for the product name, patched versions and the exact API endpoints.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000519,"input_tokens":3329,"output_tokens":372,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101273':15A,18A '-2026':14A,17A 'accept':31B 'allow':84C,107C 'api':29B,82C 'attack':6A,57B 'auto':38B,97C 'auto-incr':37B,96C 'belong':51B 'card':3A,11A,21B,34B,50B,60B,75B,92C,113C,124C,148C 'case':130C 'charg':127C 'check':47B,105C 'could':58B 'creat':42B,86C,108C 'cve':13A,16A 'differ':115C 'endpoint':30B,83C 'gift':2A,10A,20B,33B,91C,112C,123C,147C 'gift-card':19B 'host':26B 'id':4A,40B,100C,102C 'increas':142C 'increment':39B,98C 'intern':36B,99C 'learn':65B 'let':5A 'obtain':119C 'one':140C 'order':44B,87C 'organ':9A,55B,63B,116C 'packag':22B 'payment':45B,88C,109C,139C 'pretix':1A,23B 'rais':70B 'read':7A 'refer':111C 'referenc':89C 'refund':78B,136C 'secret':12A,67B,121C 'self':25B 'self-host':24B 'therebi':118C 'ticket':27B 'trigger':134C 'use':59B,94C 'valu':72B,144C 'without':46B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"655498c3-6ec5-4f0b-aea6-853b334d05a6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101273","severity":null,"published_at":"2026-10-28T11:17:13+00:00","modified_at":"2026-10-28T11:17:13+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}