An export function that gathers all reusable media inadvertently includes full gift card secrets. This disclosure occurs even when the user initiating the export lacks permission to view gift card details, violating the intended access controls. The vulnerability permits unauthorized viewing of sensitive data, potentially enabling fraud or unauthorized redemption of gift cards.

The issue affects the Pretix e‑commerce platform produced by pretix. No specific version is listed in the available data; however, the linked release notes reference a version 2026‑5‑1, implying earlier releases may be vulnerable.

The CVSS score of 3.6 indicates a moderate impact with limited exploitability. The EPSS score is not available, and the vulnerability is not recorded in the CISA KEV catalog. The attack likely occurs via the public export interface or API endpoint that the application provides for listing reusable media. An attacker who can initiate an export will, without needing to meet gift card viewing permissions, receive confidential secret values.