CVE-2026-101269 — Incorrect session validation for API-uploaded files

CVE-2026-101269

Incorrect session validation for API-uploaded files PUBLISHED

Description (CNA)

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

Affected (CNA)

Vendor / product	Versions
pretix / pretix	affected 0.0 before 2026.5.5; affected 2026.6.0 before 2026.6.2; affected 2026.7.0 before 2026.7.1

CWE

No CWE identifiers supplied.

References

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.