CVE-2026-13223

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS

No CVSS.

References

Link	Resource
https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nuestra integración de pagos con métodos de pago basados en Computop no validaba correctamente las respuestas de estado de pago. Un atacante podría usar una respuesta de estado de pago exitosa de un pago y proporcionarla al sistema para un pago diferente, obteniendo acceso a múltiples boletos válidos con un solo pago.

Information

Published : 2026-06-25 15:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-13223

Mitre link : CVE-2026-13223

CVE.ORG link : CVE-2026-13223

JSON object : View

Products Affected

No product.

CWE

CWE-841

Improper Enforcement of Behavioral Workflow

{"id": "CVE-2026-13223", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13223", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T15:14:09.758824Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "affectedData": [{"repo": "https://github.com/pretix/pretix-computop", "vendor": "pretix", "product": "pretix-computop", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.2", "versionType": "python"}], "packageName": "pretix-computop", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T15:16:34.270", "references": [{"url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2/", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "description": [{"lang": "en", "value": "CWE-841"}]}], "descriptions": [{"lang": "en", "value": "Our payment integration with Computop-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment."}, {"lang": "es", "value": "Nuestra integraci\u00f3n de pagos con m\u00e9todos de pago basados en Computop no validaba correctamente las respuestas de estado de pago. Un atacante podr\u00eda usar una respuesta de estado de pago exitosa de un pago y proporcionarla al sistema para un pago diferente, obteniendo acceso a m\u00faltiples boletos v\u00e1lidos con un solo pago."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}