CVE-2026-57536 | THREATINT

Description

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

PUBLISHED Reserved 2026-06-24 | Published 2026-06-25 | Updated 2026-06-25 | Assigner rami.io

MEDIUM: 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Problem types

CWE-841 Improper enforcement of behavioral workflow

Product status

Default status

unaffected

Any version before 2.5.6

affected

References

pretix.eu/about/en/blog/20260625-release-2026-5-2/

cve.org (CVE-2026-57536)

nvd.nist.gov (CVE-2026-57536)

Download JSON