CVE-2026-18028
Received Received - Intake

Unauthorized Configuration Changes in Event Management System

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: rami.io

Description
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-18028
EUVD
EUVD-2026-49753

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pretix pretix 2026.6.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the 'quick setup' view of an event management system. After creating an event, users can access a simplified setup interface. However, this view fails to verify if the user has proper permissions to modify the event's configuration. An attacker could exploit this by sending a carefully timed request to perform unauthorized actions like creating products, setting quotas, configuring bank transfers, or connecting a Stripe account to an event they do not own.

Detection Guidance

This vulnerability involves improper permission checks in the quick setup view of pretix. To detect it, check for unauthorized modifications to event configurations, products, quotas, or payment settings. Review logs for well-timed requests that change event settings without proper authorization.

Impact Analysis

If you are an event organizer, an attacker could gain unauthorized access to your event's configuration. This might allow them to manipulate event settings, financial details, or payment integrations without your knowledge. For users of the system, this could lead to data breaches or financial fraud if payment information is compromised.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive event data, potentially violating GDPR if personal data is exposed. For HIPAA, if the system handles protected health information, unauthorized changes to event configurations might compromise compliance. Organizations using this system should review their data handling practices and update to the patched version to maintain compliance.

Mitigation Strategies

Update your pretix installation to version 2026.6.1 or later as soon as possible to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18028. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart