CVE-2026-18028
Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
28/07/2026
Última modificación:
30/07/2026
Descripción
*** Pendiente de traducción *** The "quick setup" view presented to users after they first create an <br />
event allows to set up the most critical parts of an event in just a few<br />
clicks. This view did not properly check that the user has permission <br />
to change configuration for the given event. An attacker could use a <br />
well-timed request to create products, quotas, set bank transfer <br />
configuration, or connect a stripe account to an event they do not have <br />
access to.
Impacto
Puntuación base 4.0
2.30
Gravedad 4.0
BAJA