CVE-2026-11764

published 2026-06-09

CVE-2026-11764: When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not…

Priority P4 16 low 3.6 CVSS 4.0

AV N AC L AT P PR H UI N VC H VI N VA N SC H SI N SA N E U CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

When creating an export of all reusable media, the secrets of connected
gift cards were included in the export even if the user creating the
export does not have permission to view gift cards. This is inconsistent
with the UI and API where only the first letters of the gift card
secret are shown. Therefore, it allows circumventing a permission
boundary.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
pretix	pretix	>= 2024.1.0 < 2026.3.0	2026.3.0
pretix	pretix	>= 2026.3.0 < 2026.4.0	2026.4.0
pretix	pretix	>= 2026.4.0 < 2026.5.0	2026.5.0
pretix	pretix	>= 2026.5.0 < 2026.6.0	2026.6.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-280