CVE-2026-18028 Overview
CVE-2026-18028 is a missing authorization vulnerability in the Pretix ticketing platform. The flaw exists in the "quick setup" view shown to users immediately after creating an event. This view fails to verify that the requesting user has permission to modify the target event's configuration. Attackers with low-privileged accounts can send well-timed requests to configure events they do not own. Exploitation allows creation of products, quotas, bank transfer configuration, or connection of a Stripe account to another organizer's event. The issue is tracked as CWE-639: Authorization Bypass Through User-Controlled Key. Pretix addressed the flaw in release 2026.6.1.
Critical Impact
Authenticated attackers can hijack event configuration, including payment processor connections, on events they do not have access to manage.
Affected Products
- Pretix ticketing platform versions prior to 2026.6.1
- Self-hosted Pretix deployments exposing the quick setup workflow
- Hosted pretix.eu tenants prior to the vendor's patch rollout
Discovery Timeline
- 2026-07-28 - CVE-2026-18028 published to NVD alongside the Pretix 2026.6.1 release announcement
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18028
Vulnerability Analysis
The vulnerability resides in the Pretix "quick setup" view, which consolidates the most critical event configuration steps into a small number of HTTP requests. The view was designed to run in the short window after an authenticated user creates a new event. It did not re-validate that the currently authenticated user held permission to modify the specific event referenced in the request. An attacker holding any authenticated account on the same Pretix instance could submit crafted requests targeting an event they did not own. Because a single request can create products, define quotas, set bank transfer details, or attach a Stripe account, one successful call is sufficient to alter revenue flow. The vulnerability is categorized as [CWE-639], where access control decisions depend on a user-supplied identifier without a corresponding permission check.
Root Cause
The quick setup handler treated event creation state as implicit authorization. It relied on the assumption that only the event creator would reach the view, rather than performing an explicit permission check against the event object referenced in the request body.
Attack Vector
Exploitation requires an authenticated account on the Pretix instance and knowledge of a target event identifier. The attacker issues a well-timed HTTP POST to the quick setup endpoint referencing the victim event. The server processes the configuration changes without verifying the caller's role on that event. No user interaction from the victim is required. See the Pretix 2026.6.1 release announcement for vendor details.
Detection Methods for CVE-2026-18028
Indicators of Compromise
- Unexpected creation of products, quotas, or ticket categories on events shortly after event creation events elsewhere on the instance
- Bank transfer payment configuration changes with account details not owned by the event organizer
- Stripe Connect authorization flows initiated by accounts that do not administer the target event
- Access log entries showing quick setup endpoint requests from user IDs unrelated to the target event's owner
Detection Strategies
- Correlate application audit logs for quick setup requests against the event ownership table to flag mismatches
- Alert on Stripe or bank transfer configuration changes that occur outside normal organizer session activity
- Review Pretix logs for repeated quick setup POST requests targeting different event IDs from a single account
Monitoring Recommendations
- Enable Pretix audit logging and forward events to a centralized log platform for correlation
- Monitor payment provider dashboards for unexpected new Connect authorizations tied to unfamiliar events
- Track HTTP 200 responses on quick setup routes issued after the initial event-creation window has closed
How to Mitigate CVE-2026-18028
Immediate Actions Required
- Upgrade all Pretix installations to version 2026.6.1 or later as documented in the Pretix release announcement
- Audit recently created or modified events for unauthorized products, quotas, and payment configuration entries
- Rotate Stripe Connect authorizations and bank transfer details for any event showing unexpected configuration changes
- Review team membership and revoke unnecessary authenticated accounts on the Pretix instance
Patch Information
Pretix released version 2026.6.1 with a permission check added to the quick setup view. The fix ensures the view validates the authenticated user's role on the referenced event before applying any configuration change. Administrators should apply the update through their standard package channel or container image refresh.
Workarounds
- Restrict Pretix account creation to trusted organizer staff until patching is complete
- Place the Pretix admin interface behind an authenticated reverse proxy or VPN to limit exposure
- Temporarily disable Stripe Connect and bank transfer payment providers on the instance if patching cannot be performed immediately
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
