CVE-2026-18029 - Vulnerability Details - OpenCVE

Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Pretix Gmbh	Pretix-girosolution

No data.

No data.

References

Link	Providers
https://pretix.eu/about/en/blog/20260728-release-2026-6-1/

History

Tue, 28 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Pretix Gmbh Pretix Gmbh pretix-girosolution
Vendors & Products		Pretix Gmbh Pretix Gmbh pretix-girosolution

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Title		Insufficient validation of payment status in pretix-girosolution
Weaknesses		CWE-841
References		https://pretix.eu/about/en/blog/20260728-release-2026-6-1/
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: rami.io

Published: 2026-07-28T10:39:29.727Z

Updated: 2026-07-28T12:36:18.719Z

Reserved: 2026-07-28T07:28:43.937Z

Link: CVE-2026-18029

Vulnrichment

Updated: 2026-07-28T12:32:47.166Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18029", "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "state": "PUBLISHED", "assignerShortName": "rami.io", "dateReserved": "2026-07-28T07:28:43.937Z", "datePublished": "2026-07-28T10:39:29.727Z", "dateUpdated": "2026-07-28T12:36:18.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "shortName": "rami.io", "dateUpdated": "2026-07-28T10:39:29.727Z"}, "title": "Insufficient validation of payment status in pretix-girosolution", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-841", "description": "CWE-841 Improper enforcement of behavioral workflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "affected": [{"vendor": "pretix GmbH", "product": "pretix-girosolution", "collectionURL": "https://marketplace.pretix.eu", "packageName": "pretix-girosolution", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.1", "versionType": "python"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Our payment integration with GiroCheckout did not properly validate \npayment status responses. An attacker could use a successful payment \nstatus response from one payment and supply it to the system for a \ndifferent payment, gaining access to multiple valid tickets with only \none payment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Our payment integration with GiroCheckout did not properly validate \npayment status responses. An attacker could use a successful payment \nstatus response from one payment and supply it to the system for a \ndifferent payment, gaining access to multiple valid tickets with only \none payment."}]}], "references": [{"url": "https://pretix.eu/about/en/blog/20260728-release-2026-6-1/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T12:31:51.212712Z", "id": "CVE-2026-18029", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T12:36:18.719Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18029", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T12:31:51.212712Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T12:32:47.166Z"}}], "cna": {"title": "Insufficient validation of payment status in pretix-girosolution", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "pretix GmbH", "product": "pretix-girosolution", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.1", "versionType": "python"}], "packageName": "pretix-girosolution", "collectionURL": "https://marketplace.pretix.eu", "defaultStatus": "unaffected"}], "references": [{"url": "https://pretix.eu/about/en/blog/20260728-release-2026-6-1/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Our payment integration with GiroCheckout did not properly validate \npayment status responses. An attacker could use a successful payment \nstatus response from one payment and supply it to the system for a \ndifferent payment, gaining access to multiple valid tickets with only \none payment.", "supportingMedia": [{"type": "text/html", "value": "Our payment integration with GiroCheckout did not properly validate \npayment status responses. An attacker could use a successful payment \nstatus response from one payment and supply it to the system for a \ndifferent payment, gaining access to multiple valid tickets with only \none payment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841 Improper enforcement of behavioral workflow"}]}], "providerMetadata": {"orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "shortName": "rami.io", "dateUpdated": "2026-07-28T10:39:29.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18029", "state": "PUBLISHED", "dateUpdated": "2026-07-28T12:36:18.719Z", "dateReserved": "2026-07-28T07:28:43.937Z", "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "datePublished": "2026-07-28T10:39:29.727Z", "assignerShortName": "rami.io"}, "dataVersion": "5.2"}