PT-2026-65438
CVE-2026-18028
·
Published
2026-07-28
·
Updated
2026-07-28
Description by
CVSS 4.0
2.3
LowMetricsAV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
The product name cannot be determined (affected versions not specified)
Description
The quick setup view, used after the initial creation of an event, fails to properly verify if a user has the necessary permissions to modify the configuration of a specific event. This authorization flaw allows an attacker to send a well-timed request to perform unauthorized actions on events they do not have access to, such as creating products and quotas, configuring bank transfers, or connecting a Stripe account.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploitability
Exploit
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾