CVE-2026-57536

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

CVSS

No CVSS.

References

Link	Resource
https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nuestra integración de pagos con Mollie no validaba correctamente las respuestas de estado de pago. Un atacante podría usar una respuesta de estado de pago exitosa de un pago y proporcionarla al sistema para un pago diferente, obteniendo acceso a múltiples entradas válidas con un solo pago.

Information

Published : 2026-06-25 15:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-57536

Mitre link : CVE-2026-57536

CVE.ORG link : CVE-2026-57536

JSON object : View

Products Affected

No product.

CWE

CWE-841

Improper Enforcement of Behavioral Workflow

{"id": "CVE-2026-57536", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57536", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T15:13:22.598137Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "affectedData": [{"repo": "https://github.com/pretix/pretix-mollie", "vendor": "pretix", "product": "pretix-mollie", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.6", "versionType": "python"}], "packageName": "pretix-mollie", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}]}], "published": "2026-06-25T15:16:42.177", "references": [{"url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2/", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "description": [{"lang": "en", "value": "CWE-841"}]}], "descriptions": [{"lang": "en", "value": "Our payment integration with Mollie did not properly validate payment \nstatus responses. An attacker could use a successful payment status \nresponse from one payment and supply it to the system for a different \npayment, gaining access to multiple valid tickets with only one payment."}, {"lang": "es", "value": "Nuestra integraci\u00f3n de pagos con Mollie no validaba correctamente las respuestas de estado de pago. Un atacante podr\u00eda usar una respuesta de estado de pago exitosa de un pago y proporcionarla al sistema para un pago diferente, obteniendo acceso a m\u00faltiples entradas v\u00e1lidas con un solo pago."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}