From 803964da0e639565075a71d35314ab1751bfa82a Mon Sep 17 00:00:00 2001 From: Richard Schreiber Date: Tue, 9 Jun 2026 13:20:27 +0200 Subject: [PATCH] [SECURITY] Reusable media export: Hide giftcard secret (CVE-2026-11764 backport) (#6262) --- src/pretix/base/exporters/reusablemedia.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pretix/base/exporters/reusablemedia.py b/src/pretix/base/exporters/reusablemedia.py index fbc6005908..b53e92f9d3 100644 --- a/src/pretix/base/exporters/reusablemedia.py +++ b/src/pretix/base/exporters/reusablemedia.py @@ -69,7 +69,9 @@ class ReusableMediaExporter(OrganizerLevelExportMixin, ListExporter): date_format(medium.expires, 'SHORT_DATETIME_FORMAT') if medium.expires else '', medium.customer.identifier if medium.customer_id else '', f"{medium.linked_orderposition.order.code}-{medium.linked_orderposition.positionid}" if medium.linked_orderposition_id else '', - medium.linked_giftcard.secret if medium.linked_giftcard_id else '', + # we cannot determine here whether user has permission organizer.giftcards:read + # so default to not showing giftcard secret + medium.linked_giftcard.secret[:3] + "…" if medium.linked_giftcard_id else '', medium.notes, ] yield row