CVE-2026-101273: Giftcard enumeration

Published Oct 28, 2026

Updated

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged in this case, but by then triggering a refund on the payment, one can increase the value of the gift card.

Event History

Oct 28, 2026

CVE Published

via MITRE·10:29 AM

Data Sourced

via MITRE·10:29 AM

Description

Frequently Asked Questions

What access does an attacker need to exploit this issue?

An attacker needs access to API endpoints that can create order payments referencing a gift card by its auto-incremented internal ID. They would then need to trigger a refund on the created payment to increase the gift card's value.

What is the impact of a successful exploit?

An attacker can create payments that reference gift cards belonging to different organizers and obtain the gift card secret. Although the gift card is not charged by the initial payment, refunding that payment can increase the gift card's value.

Are gift cards consumed when the cross-organizer payment is created?

No. The description states that the gift card is not charged in this case; the value increase occurs when the attacker triggers a refund on the payment.

CVE-2026-101273: Giftcard enumeration

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of a successful exploit?

Are gift cards consumed when the cross-organizer payment is created?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the impact of a successful exploit?

Are gift cards consumed when the cross-organizer payment is created?