Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
CVE-2026-13223: pretix-computop can issue tickets without proper payment
CVE-2026-13223 · published 4 months ago
Summary
The pretix-computop add‑on does not correctly check that a payment status matches the order it belongs to. This allows someone to reuse a confirmation from one purchase to obtain tickets for other orders without paying. Update the integration or apply the vendor’s fix to ensure each payment is verified against its own order.
Original advisory text
Insufficient validation of payment status in pretix-computop
Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
References
- https://pypi.python.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13223... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-13223 Vendor Advisory
- https://github.com/pretix/pretix-computop Product
- https://pretix.eu/about/en/blog/20260625-release-2026-5-2/ Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.3
High
Type
CWE-841Improper Enforcement of Behavioral Workflow
Timeline
Published25 Jun 2026
Updated4 Nov 2026
First seen25 Jun 2026
Track software like this
Free during beta