---
id: "CVE-2026-101273"
kind: "vulnerability"
aliases: ["CVE-2026-101273"]
title: "Pretix: gift card IDs let attackers read other organizers' gift card secrets"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gift-cards", "package", "pretix", "self-hosted", "ticketing"]
not_affected_if: []
published_at: "2026-10-28T11:17:13+00:00"
first_seen_at: "2026-10-28T11:32:27+00:00"
updated_at: "2026-10-28T11:33:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101273", "first_seen_at": "2026-10-28T11:32:27+00:00"}]
---

# Pretix: gift card IDs let attackers read other organizers' gift card secrets

Some API endpoints accepted a gift card's internal auto-incremented ID when creating an order payment, without checking that the card belonged to the same organizer. An attacker could use cards from other organizers to learn their secret and then raise the value of a card through a refund.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T11:32:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101273

## From the sources

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_