CVE-2026-11764: Authentication Bypass Vulnerability

CVE-2026-11764 Overview

CVE-2026-11764 is an information disclosure vulnerability in Pretix, an open-source ticketing platform. When a user generates an export of all reusable media, the export includes the full secrets of any connected gift cards. The export ignores the permission boundary that normally restricts gift card visibility. The user interface and API only display the first letters of a gift card secret, so the export inconsistency lets operators read values they should not access. The flaw maps to CWE-280: Improper Handling of Insufficient Permissions or Privileges.

Critical Impact
An authenticated Pretix user without gift card permissions can extract full gift card secrets by generating a reusable media export, enabling unauthorized redemption of stored value.

Affected Products

Pretix self-hosted and Pretix Hosted ticketing platform
Pretix releases prior to version 2026.5.1
Deployments that use reusable media linked to gift cards

Discovery Timeline

2026-06-09 - Pretix publishes release 2026.5.1 containing the fix, as documented in the Pretix Blog Release Announcement
2026-06-09 - CVE-2026-11764 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11764

Vulnerability Analysis

The vulnerability resides in the reusable media export routine of Pretix. Reusable media records can be linked to gift cards, which store monetary value redeemable at checkout. The export feature serializes media records along with their related gift card objects. The serializer writes the full gift card secret field into the output file. The same secret is masked in the web UI and API responses, where only the leading characters are returned to non-privileged users.

The export path does not consult the gift card permission check that gates the UI and API surfaces. A user holding permission to manage reusable media but lacking the can_view_giftcards (or equivalent) organizer permission therefore receives the unredacted secret. Possession of the full secret is sufficient to redeem the associated balance at any participating event, bypassing the organizer's segregation of duties.

Root Cause

The export logic implements its own data assembly without reusing the permission filters applied by the gift card views. This is a classic instance of inconsistent enforcement of an authorization boundary across multiple code paths, captured by [CWE-280]. Permission decisions made in one component are not propagated to a sibling component handling the same data.

Attack Vector

An attacker must already hold an authenticated account in the Pretix organizer with rights to create reusable media exports. The attacker triggers the standard export job and downloads the resulting file. The file contains plaintext gift card secrets that the same attacker cannot view through the UI. The attacker then redeems the gift cards or sells the secrets externally. No network-level exploit is required beyond the normal authenticated session.

No public proof-of-concept exploit is listed in ExploitDB and the issue is not on the CISA Known Exploited Vulnerabilities catalog. The EPSS data indicates a very low probability of widespread exploitation, consistent with the requirement for elevated, authenticated access.

Detection Methods for CVE-2026-11764

Indicators of Compromise

Reusable media export jobs initiated by users who do not hold gift card view permissions.
Downloaded export artifacts containing the field secret with values longer than the masked prefix shown in the UI.
Unexpected gift card redemptions shortly after a reusable media export was generated.
Audit log entries showing export.run actions by accounts limited to media management.

Detection Strategies

Review Pretix audit logs for export creation events and correlate the acting user's role against gift card permissions.
Inspect generated export files at rest for plaintext gift card secrets before delivering them to requesters.
Alert on gift card redemptions that occur from users or sales channels not previously associated with the issuing organizer.
Compare the Pretix instance version against 2026.5.1 to confirm patch state across all organizer tenants.

Monitoring Recommendations

Forward Pretix application and web server logs to a central log store and retain export-related events for at least 90 days.
Monitor object storage or filesystem locations that hold generated export files for unusual download patterns.
Track changes to organizer team permissions, especially additions to reusable media management roles.

How to Mitigate CVE-2026-11764

Immediate Actions Required

Upgrade Pretix to version 2026.5.1 or later on all self-hosted instances. Pretix Hosted customers are patched by the vendor.
Rotate gift card secrets for any cards that may have been included in past reusable media exports.
Review team memberships and remove reusable media export rights from users who do not require them.
Purge any historical export files from storage backends, email systems, and user workstations.

Patch Information

The fix is included in Pretix release 2026.5.1, announced in the Pretix Blog Release Announcement. The release aligns the reusable media export with the gift card permission boundary, masking secrets for users without the appropriate organizer permission.

Workarounds

Restrict the reusable media export permission to administrators who already hold gift card view rights until the patch is deployed.
Disable the reusable media export feature in operational procedures and provide filtered data extracts on request.
Apply file-level access controls so that generated export artifacts are only readable by gift-card-privileged staff.

bash

# Verify the running Pretix version and upgrade via pip in a virtualenv deployment
pretix --version
pip install --upgrade "pretix>=2026.5.1"
systemctl restart pretix-web pretix-worker