nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18029 CVE-2026-18029
MEDIUM
Insufficient validation of payment status in pretix-girosolution
Record summary
CVE-2026-18029 has a selected CVSS score of 6.3 (medium).
Description
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 28, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
pretix-girosolutionBrowse pretix GmbH / pretix-girosolutionDefault status: unaffected | CVE List | Before 1.0.1 | affected |
References
2pretix.euVendor advisory
https://pretix.eu/about/en/blog/20260728-release-2026-6-1