From 48f5a7c8cc6d51690ba1bf46b606759456f4b63a Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Mon, 21 Sep 2026 13:55:28 +0200 Subject: [PATCH] [SECURITY] Fix information leak in widgets.json on dashboard (CVE-2026-101267, Z#23247172) Thanks to Wenhao Wu, Southeast University --- src/pretix/control/views/dashboards.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/pretix/control/views/dashboards.py b/src/pretix/control/views/dashboards.py index cfa98a562..cf14680b6 100644 --- a/src/pretix/control/views/dashboards.py +++ b/src/pretix/control/views/dashboards.py @@ -402,9 +402,12 @@ def event_index_widgets_lazy(request, organizer, event): except SubEvent.DoesNotExist: pass + can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read', + request=request) widgets = [] - for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False): - widgets.extend(result) + if can_view_orders: + for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False): + widgets.extend(result) return build_json_response(widgets)