CVE-2026-13223

MediumCVSS 6.3/10Last modified Oct 25, 2026

Description

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-841

Affected software

Vendor	Product	Versions
pretix	pretix-computop	< 1.3.2

References

https://pretix.eu/about/en/blog/20260625-release-2026-5-2/

Timeline

Published: Jun 25, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-132244.9A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary fil CVE-2026-132255.3Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation p CVE-2026-132266.5The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'after' para CVE-2026-132277.1An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whiteli CVE-2026-132288.8The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administra CVE-2026-132297.1Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint.CVE-2026-13238.8The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to e CVE-2026-132306.5An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes s CVE-2026-132316.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Advanced Content Feedback (aka CVE-2026-132323.1Incorrect Authorization vulnerability in Drupal Advanced Content Feedback (aka admin_feedback) allows Forceful Browsing. This issue affects CVE-2026-132333.3Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenAI Provider allows Server Side Request Forgery. This issue affects OpenAI Pro CVE-2026-132346.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) al