CVE-2026-101273 in pretix: Gift Card Vulnerability Allows Unauthorised Balance Increases and Refund Abuse

On 28 October 2026, a security vulnerability identified as CVE-2026-101273 was disclosed in pretix, an e-commerce platform used for online ticket sales and event management. The flaw could allow a user with limited privileges to access gift cards belonging to other event organisers, expose their confidential card secrets and artificially increase their balances through improperly processed payment refunds. The vulnerability received a CVSS 4.0 score of 5.3, placing it in the medium-severity category. However, its potential financial consequences make it particularly relevant to businesses that sell tickets, vouchers and other products using stored-value payment systems.

The problem arises from insufficient access controls when payment records are created through the pretix API. Under certain conditions, the system allowed a gift card to be referenced using its internal identifier without adequately checking whether the card belonged to the organiser associated with the payment. Because these identifiers were assigned sequentially, referencing another organiser’s gift card could expose its secret code. A separate weakness in the refund process could then allow funds to be credited to the card without a corresponding previous deduction.

The pretix development team addressed the vulnerability in versions 2026.6.4, 2026.7.3 and 2026.8.1, released on 28 October 2026. Administrators of self-hosted installations should verify their software versions, review the permissions assigned to API users and examine unusual activity involving gift cards and payment refunds. The issue is especially important for platforms hosting multiple independent event organisers within the same installation.

What is pretix and how does online ticket selling work?

Pretix is an e-commerce platform designed for online ticket sales and event management. It is used by organisers of conferences, concerts, festivals, exhibitions, training sessions and other events that require ticket purchases or reservations. The system allows businesses to create online ticket shops, configure different ticket categories, accept payments and manage orders and attendees. It is available both as a hosted service and as software that organisations can deploy on their own infrastructure.

One of the features available in pretix is gift card management. Gift cards can be purchased by customers, issued as part of promotional activities or used when processing certain refunds. Each card represents a monetary value that customers can spend on eligible orders. Unlike a conventional discount code, a gift card has a balance that decreases when funds are used to pay for purchases. Depending on the configuration, its balance may also be increased through legitimate refunds or other authorised transactions.

Pretix supports multiple event organisers within a single installation. Each organiser can manage its own events, products, orders and payment settings, while appropriately configured gift cards may also be accepted by other participating organisers. This makes the platform suitable for businesses managing several events or running a shared ticketing environment. However, it also makes strict separation of permissions essential, particularly when the system handles financial information belonging to different organisations.

CVE-2026-101273 affected this separation of access rights. The vulnerability was not simply related to the legitimate acceptance of gift cards across different organisers. Instead, certain API operations could reference gift cards belonging to other organisers without sufficiently verifying whether the requesting user was authorised to access them. This could result in the disclosure of a gift card secret and the subsequent misuse of the refund mechanism to increase its stored value.

CVE-2026-101273: What exactly is the pretix gift card vulnerability?

CVE-2026-101273 concerns unauthorised references to gift cards and the disclosure of their confidential secrets. According to the published vulnerability description, the issue involves two related weaknesses: insufficient access control over gift card records belonging to other organisers and the possibility of incorrectly crediting gift card balances through refund operations. Together, these problems create a risk to the integrity of the platform’s financial records.

Each pretix gift card has several attributes, including an internal identifier, a secret code, a balance, a currency and information identifying the organiser that issued it. The internal identifier is used by the application to locate the corresponding database record. The confidential gift card code serves a different purpose and may be required when using the card to make a payment.

These two values should remain separate from a security perspective. Knowing the internal identifier of a record should never automatically grant permission to retrieve its confidential code or perform financial transactions involving it. Proper authorisation checks must verify that the requesting user or API token has access to the particular gift card, not merely permission to access the general payment functionality.

In the affected pretix versions, certain payment creation endpoints accepted a gift card’s internal identifier without adequately checking whether the card belonged to the relevant organiser. This could allow a payment record to reference another organiser’s gift card and expose its secret. A correctly secured implementation should reject such requests unless the user or integration has the necessary permissions for the specific resource.

The second weakness involved refund processing. In the affected scenario, creating a payment record did not necessarily deduct funds from the referenced gift card. However, a subsequent refund operation could increase the card’s balance. This meant that the system could credit money that had never actually been deducted in the first place.

The financial significance of CVE-2026-101273 lies in the possibility of creating gift card value without a corresponding legitimate payment or debit. The vulnerability therefore affects more than the confidentiality of gift card information. It can also undermine the accuracy of balances and the integrity of payment records.

Why internal gift card identifiers must never replace proper authorisation

Many web applications use numerical identifiers to distinguish individual database records. Orders, payments, invoices, customer accounts and gift cards may receive sequential numbers when they are created. This approach is common and does not, by itself, represent a security vulnerability. The problem occurs when an application treats knowledge of an identifier as sufficient permission to access or modify the corresponding record.

In a multi-organiser ticketing system, access control must establish more than whether a user can perform a particular type of operation. It must also verify whether the user is authorised to perform that operation on the specific resource involved. Someone who can manage payments for one event should not automatically be able to access confidential gift card information belonging to another organiser.

These checks must take place on the server. Restricting the information displayed in an administration panel is not enough if the underlying API still accepts requests referencing records outside the user’s permitted scope. An attacker may interact with an API directly rather than using the graphical interface provided by the application.

CVE-2026-101273 demonstrates how a failure to enforce record-level permissions can affect the financial processes of an entire platform. An application may successfully authenticate a user and confirm that the user has general permission to create payment records, yet still fail to verify ownership of the particular gift card referenced by the request.

This type of problem belongs to the broader category of improper access control vulnerabilities. Similar weaknesses can affect order management systems, customer accounts, subscription services and online marketplaces when record identifiers are accepted without adequate authorisation checks.

It is also important to understand the conditions required to exploit the pretix vulnerability. The published CVSS 4.0 assessment indicates that low-level privileges are required. CVE-2026-101273 should therefore not be described as a confirmed method allowing any completely unauthenticated visitor to increase gift card balances simply by entering a card number.

How can an incorrectly processed refund artificially increase a gift card balance?

In a properly functioning payment system, charges and refunds should be linked to genuine financial transactions. When a customer pays for an event ticket using a gift card, the relevant amount is deducted from the available balance. If the purchase is subsequently cancelled and a refund is authorised, the system may restore the amount previously deducted from the card.

Consider a gift card with an initial balance of €100. If the customer spends €30 on an event ticket, the remaining balance should be €70. If that payment is legitimately refunded, the balance may return to €100. However, the system should not increase the value to €130 unless a separate authorised top-up or equivalent financial transaction has occurred.

The weakness described in CVE-2026-101273 could break this relationship between the original payment and the subsequent refund. A payment record could be associated with a gift card without actually reducing its balance. If the refund mechanism then added funds back to that card, the system could create additional stored value without receiving any corresponding money.

This represents a failure of financial transaction integrity. Every increase in stored value should be supported by a legitimate event, such as a payment, an authorised manual adjustment or a refund of funds that were genuinely deducted. When the underlying application does not consistently enforce this relationship, a user may be able to exploit the accounting logic to generate an invalid balance.

Such errors can be harder to identify than straightforward failed payments. An administrator may see a refund record and a corresponding increase in a gift card balance, even though the original payment did not involve an actual deduction. Without proper reconciliation between payment records, refunds and balance changes, the discrepancy may remain unnoticed.

The existence of this vulnerability does not establish that every pretix installation has experienced fraudulent gift card activity. The security advisory documents a technically possible abuse scenario. At the time of disclosure, it did not establish that a widespread campaign had successfully exploited the issue across affected installations.

Which pretix versions are vulnerable to CVE-2026-101273?

The official vulnerability record published on 28 October 2026 identifies the affected software versions and the releases containing the security fix. Updates were made available for three supported pretix release branches, allowing administrators to address the issue without necessarily switching immediately to the latest feature release.

All three corrected versions were released on 28 October 2026. Versions 2026.6.4 and 2026.7.3 provide security fixes for administrators remaining on the corresponding older branches, while 2026.8.1 is the corrected release for the 2026.8 branch.

Operators using older installations should consider upgrading to an actively supported release in accordance with the developer’s documentation and the requirements of any installed extensions. Before updating, it is important to review the compatibility of payment integrations, ticketing extensions and other components that interact with pretix.

Administrators should also remember that updating the core platform does not automatically mean that every third-party plugin or external integration is fully up to date. A complete security review should include supporting components that can create payments, initiate refunds or access gift card information.

What does CVE-2026-101273 mean for ticket sellers and event organisers?

The most significant potential consequence is a loss of financial integrity. If gift card balances can be increased without a corresponding legitimate payment, an attacker may be able to spend value that was never actually purchased or authorised. For an event organiser, this could result in tickets being issued in exchange for improperly created credit.

The second concern is the disclosure of confidential gift card codes. Where possession of a secret enables particular gift card operations, unauthorised access to that information may create additional opportunities for misuse. The actual consequences depend on how the relevant gift card has been configured and which organisers are permitted to accept it.

A shared pretix installation serving multiple organisations creates additional considerations. Each organiser should be able to manage its own orders, payments and gift cards without exposing confidential financial information to unrelated organisations. A weakness that allows a user associated with one organiser to reference another organiser’s cards can undermine these boundaries.

The vulnerability does not mean that all online ticketing systems or e-commerce platforms contain the same flaw. CVE-2026-101273 specifically concerns pretix. WooCommerce, Magento, PrestaShop and Shopify are not automatically affected by this CVE simply because they support gift cards, refunds or stored-value payments.

Nevertheless, the underlying security issue is relevant to the wider e-commerce industry. Online retailers, marketplaces and ticketing businesses frequently use gift cards, customer balances, credit wallets and refund systems. These features require careful validation because errors in authorisation or transaction accounting can have direct financial consequences even when the traditional payment gateway itself remains secure.

How to check your pretix version and install the security update

Administrators should begin by identifying the exact pretix version running in their environment. Depending on the deployment method, this information may be available through the administration interface, the installation documentation or the Python environment in which the application is installed.

For a self-hosted installation running inside an activated Python virtual environment, the installed package version can be checked using:

python -m pip show pretix

The result should be verified against the environment actually used by the running service. A package installed in the system’s default Python interpreter may differ from the version used by an isolated virtual environment or container.

For container-based deployments, administrators should inspect the image version and deployment configuration. Where the system uses separate processes for the web application, background tasks and scheduled operations, those components should all be updated according to the supported deployment procedure.

Before performing the update, create a reliable backup of the database and relevant application configuration. A ticketing platform contains information about purchases, payments, attendees, refunds and gift card balances, so preserving transaction consistency is particularly important.

The update should be installed using the procedure appropriate for the existing deployment. After installation, verify the running pretix version and test essential functions, including ticket purchases, payment processing, legitimate refunds and gift card redemption.

Businesses using pretix Hosted should check the service operator’s update status if confirmation of the relevant security fix is not available in their account or service communications. Organisations running their own installations remain responsible for deploying the appropriate patched version and validating the result.

How to detect suspicious gift card transactions and refund activity

After installing the security update, administrators should consider reviewing transactions processed while the affected version was active. Because CVE-2026-101273 may allow unauthorised increases in gift card balances, the investigation should focus on the relationship between gift card debits, refunds and balance adjustments.

One important warning sign is a refund that increases a gift card balance without a corresponding previous deduction. Such transactions should be investigated using the related order records, original payment information and gift card transaction history.

Administrators should also examine activity involving more than one organiser. If a payment or refund references a gift card issued by another organisation, it is necessary to establish whether that cross-organiser use was legitimate and properly authorised.

Pretix supports valid cross-organiser gift card arrangements, so the mere existence of a transaction involving two organisations does not prove fraudulent behaviour. The relevant question is whether the card was correctly authorised for that transaction and whether the resulting change in balance was supported by a genuine financial event.

Gift card transaction histories may include information such as transaction identifiers, dates, amounts, related orders, events and the organisers that accepted the card. These details can help administrators reconcile the financial history of a card and identify changes that require explanation.

Where practical, businesses should compare the sum of legitimate top-ups and refunds against the total value redeemed and the remaining balance. An unexplained difference may indicate an accounting error, an unauthorised adjustment or another problem requiring further investigation.

Not every unusual balance adjustment is evidence of CVE-2026-101273 exploitation. Legitimate manual corrections, customer service adjustments and authorised refunds may also change a card’s value. Findings should be evaluated against the complete transaction history rather than treating isolated records as proof of an attack.

How to improve the security of pretix APIs and gift card payments

Installing the patched pretix release is the primary measure required to address CVE-2026-101273. However, businesses can further reduce the risk of financial abuse by reviewing the permissions assigned to users and API integrations.

The principle of least privilege is particularly important. Every account and API token should be granted only the access required to perform its intended function. A system used solely to retrieve event information should not receive broad financial permissions unless those permissions are genuinely necessary.

For multi-organiser installations, administrators should carefully review which accounts can create payments, initiate refunds, view gift card details and manage financial settings. Access rights should reflect the organisational boundaries within the platform, including any legitimate arrangements allowing gift cards to be accepted by more than one organiser.

Unused API tokens should be revoked, and credentials belonging to former service providers or completed integrations should not remain active indefinitely. Where integrations require financial permissions, their activities should be monitored and their credentials managed as sensitive information.

If updating immediately is not possible, temporarily restricting access to relevant payment creation or refund functionality may help reduce exposure. Such changes must be evaluated carefully because they may interrupt legitimate sales and customer service processes. They should not be treated as equivalent to applying the official fix.

A conventional web application firewall also cannot be assumed to correct an application-level authorisation failure. The vulnerability concerns how pretix validates access to individual resources and processes financial transactions. Filtering suspicious network traffic may provide additional protection, but it cannot replace the corrected application logic.

Regular financial reconciliation is another valuable safeguard. Comparing gift card balances with actual payments, refunds and authorised adjustments can help detect discrepancies before they result in substantial losses. This does not prevent every form of abuse, but it improves visibility into the integrity of stored-value transactions.

What should you do if you suspect exploitation of CVE-2026-101273?

If suspicious gift card activity is identified, the first priority is to preserve the relevant evidence and establish whether the transactions could have resulted from the vulnerability. Administrators should retain available API logs, order records, payment details, refund information and gift card transaction histories.

It is also important to identify which users and integrations possessed the permissions needed to perform the relevant operations. This can help distinguish legitimate administrative activity from misuse of an authorised account, compromised credentials or exploitation of the vulnerable application behaviour.

If unauthorised increases in gift card balances are confirmed, the business should determine their financial value and whether the additional credit has already been redeemed. Depending on the circumstances, it may be necessary to restrict further use of affected cards, correct balances using the documented financial records and investigate orders paid for with improperly created credit.

Any corrective action should preserve a clear audit trail. Simply deleting suspicious transaction records can make it more difficult to understand what happened and to reconcile the financial consequences later.

Administrators should also review the security of related API accounts and integrations. If there is evidence that an API token was compromised or improperly authorised, revoking that credential and issuing a replacement may be appropriate.

Changing every user’s password is not automatically required solely because CVE-2026-101273 exists. The vulnerability was not described as a mechanism for directly taking over arbitrary administrator accounts. Credential changes should be based on the evidence collected during the incident investigation.

In environments serving multiple organisers, it is particularly important to determine whether gift card secrets belonging to one organisation were exposed through operations performed by another. The investigation should establish which parties and resources were affected before any conclusions are drawn about the scope of the incident.

A financial integrity incident does not automatically constitute a personal data breach. However, where identifiable customer information was also exposed, businesses may need to assess their obligations under applicable privacy and data protection legislation, including the GDPR where relevant.

Frequently asked questions about CVE-2026-101273

Can CVE-2026-101273 increase a gift card balance without a genuine payment?

Yes. The published vulnerability description confirms a scenario in which a refund can increase a gift card balance even though the card was not previously charged for the corresponding payment record. This can create stored value without a legitimate underlying financial transaction.

Does exploiting this vulnerability require an account?

The published CVSS 4.0 assessment indicates that low-level privileges are required. It should not be described as a confirmed vulnerability allowing a completely unauthenticated visitor to increase arbitrary gift card balances immediately.

Are all online ticketing systems vulnerable?

No. CVE-2026-101273 specifically affects pretix. Other ticketing platforms and e-commerce systems are not automatically vulnerable simply because they offer gift cards or support payment refunds.

Which pretix versions contain the security fix?

The vulnerability was addressed in pretix versions 2026.6.4, 2026.7.3 and 2026.8.1, released on 28 October 2026. Administrators should install the appropriate patched release for their environment.

Have the codes of all pretix gift cards been exposed?

There is no evidence supporting such a conclusion. The vulnerability could allow an authorised user with limited privileges to reference another organiser’s gift card and expose its secret under the affected conditions. The presence of the vulnerability alone does not establish that every card was accessed.

Have active attacks exploiting CVE-2026-101273 been confirmed?

At the time of the disclosure on 28 October 2026, the reviewed advisory did not establish a widespread campaign exploiting the vulnerability. The technical weakness was nevertheless confirmed, and patched releases were made available.

Is disabling refunds enough to protect a vulnerable pretix installation?

Temporarily restricting refunds may reduce the risk associated with the balance-increase scenario, but it does not resolve the underlying access control problem. Installing the official security update is necessary to address the vulnerability properly.

Can pretix gift cards legitimately be accepted by different organisers?

Yes. Pretix supports appropriately configured gift card arrangements involving multiple organisers. CVE-2026-101273 concerns unauthorised access to another organiser’s gift card records, not the legitimate sharing of gift card acceptance between participating organisations.

Why secure gift card accounting matters for the wider e-commerce industry

CVE-2026-101273 illustrates that e-commerce cybersecurity threats are not limited to stolen administrator passwords, compromised payment pages or the theft of customer information. Vulnerabilities in business logic can also cause serious problems when they allow a system to create financial value without a corresponding legitimate transaction.

In pretix, the issue involved insufficient access control over gift cards belonging to different organisers and the possibility of using refund processing to increase a balance improperly. This is particularly relevant to multi-organisation platforms, where a failure to enforce boundaries between accounts can affect parties that share the same technical infrastructure.

Operators of affected pretix installations should install the appropriate patched release without unnecessary delay and review transactions involving gift cards and refunds. Each balance adjustment should be supported by a genuine, authorised financial operation, while users and API integrations should have access only to the resources they are permitted to manage.

The broader lesson applies to online retailers, marketplaces, event platforms and other businesses that offer stored-value products. Gift cards, customer wallets, refunds and account credits must remain consistent with actual payments and authorised adjustments. Strong access controls, reliable transaction records, timely security updates and regular reconciliation are essential to protecting these systems against both technical exploitation and financial abuse.

Official sources

pretix – Security Release 2026.8.1, official release announcement dated 28 October 2026.

CVE Program – CVE-2026-101273, vulnerability description, affected versions and CVSS 4.0 assessment.

pretix Documentation – Gift Cards, official guidance on gift card payments, balances and refunds.