From afe87dcda1a25a8bded9e21dc55e817d6f23ad24 Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Mon, 21 Sep 2026 13:55:28 +0200 Subject: [PATCH] [SECURITY] Fix information leak in widgets.json on dashboard (CVE-2026-101267, Z#23247172) Thanks to Wenhao Wu, Southeast University --- src/pretix/control/views/dashboards.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/src/pretix/control/views/dashboards.py b/src/pretix/control/views/dashboards.py index 02bddc996..fb3a6cdb4 100644 --- a/src/pretix/control/views/dashboards.py +++ b/src/pretix/control/views/dashboards.py @@ -414,9 +414,12 @@ def event_index_widgets_lazy(request, organizer, event): except SubEvent.DoesNotExist: pass + can_view_orders = request.user.has_event_permission(request.organizer, request.event, 'event.orders:read', + request=request) widgets = [] - for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False): - widgets.extend(result) + if can_view_orders: + for r, result in event_dashboard_widgets.send(sender=request.event, subevent=subevent, lazy=False): + widgets.extend(result) return JsonResponse({'widgets': widgets})