CVE-2026-18029

Published: Lug 28, 2026 Last Modified: Lug 28, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: 655498c3-6ec5-4f0b-aea6-853b334d05a6
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A

Description

AI Translation Available

Our payment integration with GiroCheckout did not properly validate
payment status responses. An attacker could use a successful payment
status response from one payment and supply it to the system for a
different payment, gaining access to multiple valid tickets with only
one payment.

841

Improper Enforcement of Behavioral Workflow

Incomplete
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Other
Potential Impacts:
Alter Execution Logic
Applicable Platforms
All platforms may be affected
View CWE Details
https://pretix.eu/about/en/blog/20260728-release-2026-6-1/
https://pretix.eu/about/en/blog/20260728-release-2026-6-1/