Medium severity · published Jun 25, 2026
CVE-2026-13223
Insufficient validation of payment status in pretix-computop
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix-computop · pretix
before 1.3.2 · source: vendor