« Volver al listado

CVE-2026-11764

Estado: AplazadaBaja (3.6)—

When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-11764",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-11764",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T13:49:30.786909Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 3.6,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "UNREPORTED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "affectedData": [
        {
          "repo": "https://github.com/pretix/pretix",
          "vendor": "pretix",
          "product": "pretix",
          "versions": [
            {
              "status": "affected",
              "version": "2024.1.0",
              "lessThan": "2026.3.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2026.3.3",
                  "status": "unaffected"
                }
              ],
              "version": "2026.3.0",
              "lessThan": "2026.4.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2026.4.3",
                  "status": "unaffected"
                }
              ],
              "version": "2026.4.0",
              "lessThan": "2026.5.0",
              "versionType": "python"
            },
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2026.5.1",
                  "status": "unaffected"
                }
              ],
              "version": "2026.5.0",
              "lessThan": "2026.6.0",
              "versionType": "python"
            }
          ],
          "packageName": "pretix",
          "collectionURL": "https://pypi.org/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T13:16:35.533",
  "references": [
    {
      "url": "https://pretix.eu/about/en/blog/20260609-release-2026-5-1/",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6",
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When creating an export of all reusable media, the secrets of connected \ngift cards were included in the export even if the user creating the \nexport does not have permission to view gift cards. This is inconsistent\n with the UI and API where only the first letters of the gift card \nsecret are shown. Therefore, it allows circumventing a permission \nboundary."
    },
    {
      "lang": "es",
      "value": "Al crear una exportación de todos los medios reutilizables, los secretos de las tarjetas de regalo conectadas se incluyeron en la exportación incluso si el usuario que crea la exportación no tiene permiso para ver las tarjetas de regalo. Esto es inconsistente con la interfaz de usuario (UI) y la API, donde solo se muestran las primeras letras del secreto de la tarjeta de regalo. Por lo tanto, permite eludir un límite de permisos."
    }
  ],
  "lastModified": "2026-07-23T08:10:00.137",
  "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"
}