Vulnerability in Pretix Gmbh Pretix-Girosolution
CVE-2026-18029
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.
Affected products
- Pretix Gmbh Pretix-girosolution — versions 0
Weakness classification (CWE)
References
- 655498c3-6ec5-4f0b-aea6-853b334d05a6 (vendor-advisory)