CVE-2026-18028

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The quick setup view, used after the initial creation of an event, fails to properly verify if a user has the necessary permissions to modify the configuration of a specific event. This authorization flaw allows an attacker to send a well-timed request to perform unauthorized actions on events they do not have access to, such as creating products and quotas, configuring bank transfers, or connecting a Stripe account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.