CVE-2026-18029 — Insufficient validation of payment status in pretix-girosolution

CVE-2026-18029

Insufficient validation of payment status in pretix-girosolution PUBLISHED

Description (CNA)

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

Affected (CNA)

Vendor / product	Versions
pretix GmbH / pretix-girosolution	affected 0 before 1.0.1

CWE

CWE-841

References

https://pretix.eu/about/en/blog/20260728-release-2026-6-1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.