CVE-2026-18028
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
28/07/2026
Last modified:
30/07/2026
Description
The "quick setup" view presented to users after they first create an <br />
event allows to set up the most critical parts of an event in just a few<br />
clicks. This view did not properly check that the user has permission <br />
to change configuration for the given event. An attacker could use a <br />
well-timed request to create products, quotas, set bank transfer <br />
configuration, or connect a stripe account to an event they do not have <br />
access to.
Impact
Base Score 4.0
2.30
Severity 4.0
LOW