CVE-2026-101267

Description

A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.

References

• https://pretix.eu/about/en/blog/20260929-release-2026-7-1/