LOW 2.3 NVD

CVE-2026-101269

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.

References

https://pretix.eu/about/en/blog/20260929-release-2026-7-1/

Published: 2026-09-29 · Source: NVD · Feed updated: 2026-09-30

This low severity vulnerability with a CVSS score of 2.3 was published on 2026-09-29 via NVD.

vulnfeed aggregates 10239 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.