pretix CVE-2026-13602

Exploitation requires the attacker to already hold authenticated access to at least one event in the pretix backend (CVSS PR:L), so this is an insider/multi-tenant escalation, not remote-unauthenticated. Concrete prerequisites: (1) at least one of the affected payment plugins (or bundled Stripe) must be present so the unvalidated signed-session-parameter transport code path exists; (2) the core Referer-obfuscation redirect feature must be reachable to serve as the signing oracle that reuses the shared key/salt; and (3) the core admin "act on behalf of" impersonation feature must be usable, with the attacker guessing a valid target user ID. Limiting factors: the need for an existing backend account bounds the attacker population; the impact is greatest on shared or SaaS instances with many low-trust organizers, and much lower on single-tenant deployments where the operator is already fully trusted. No end-user interaction is required (UI:N).

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with High confidentiality/integrity/availability on both vulnerable and subsequent systems) scores 7.7 and is internally consistent with the described impact: a network-reachable, low-complexity chain that requires only low privileges (access to at least one event in the backend) and no user interaction, yielding full account takeover. The E:U flag (Exploit Unproven) means no public exploit is identified at time of analysis, and there is no CISA KEV listing and no EPSS value provided - so despite the high severity there is no signal of active or automated exploitation. The most important qualifier is PR:L: this is not a pre-auth internet-wide risk but an insider/multi-tenant escalation, most dangerous on shared/SaaS pretix deployments where many low-trust organizers share one backend. The realism is high (the vendor describes a concrete, working three-stage chain and shipped fixes), but the barrier of already needing a backend event account meaningfully narrows the attacker population. Note: no independent confirmation of exploitability beyond the vendor blog; treat exploit maturity as unproven rather than absent.

A malicious event organizer with a legitimate low-privilege backend account on a shared pretix instance crafts links against the Referer-obfuscation redirect feature to have the server cryptographically sign arbitrary session parameters, then injects that signed blob into a payment plugin's session-transport path, which accepts it because only the signature is checked. Having written attacker-controlled parameters into their own session, they invoke the admin "act on behalf of" impersonation feature and guess a target user ID to switch into any account and read all its data. No public exploit is identified at time of analysis, but the network vector and low attack complexity (AV:N/AC:L) make the chain straightforward for an attacker who already holds backend access.