Description (CNA)
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| pretix GmbH / pretix | affected 0 before 2026.4.6; affected 2026.5.0 before 2026.5.4; affected 2026.6.0 before 2026.6.1 |
CWE
CWE-639
References
ADP enrichment
No English description supplied.
No references supplied.