CVE-2026-18028
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The quick setup view shown to users after creating an event does not properly check user permissions to change configuration for that event. An attacker can use a well-timed request to create products, quotas, set bank transfer configuration, or connect a Stripe account to an event they do not have access to.
Risk Assessment
Attackers can unauthorizedly modify event settings, potentially leading to financial losses, data integrity breaches, and unauthorized access to payment systems.
Recommendation
Immediately update the software to the latest version that includes a fix for permission checking in the quick setup view.
Original NVD description (English source)
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.