Is there a patch available for CVE-2026-57536?

Yes, a patch is available for CVE-2026-57536. Update the affected software to the latest version immediately.

pretix-mollie CVE-2026-57536

Q: What is the CVSS score of CVE-2026-57536?

CVE-2026-57536 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-39415 MEDIUM

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-06-25 rami.io

GHSA-x2gq-qh4v-9777

Information Disclosure Pretix Pretix Mollie

6.3

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network vector, high complexity requiring a prior valid payment; no privileges, no user interaction; only low integrity impact via fraudulent ticket issuance.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:18 vuln.today

DescriptionCVE.org

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

AnalysisAI

Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusing a single legitimate Mollie payment confirmation. The plugin fails to bind payment status responses to their originating transaction, so a successful payment callback for order A can be submitted against order B. No active exploitation or public proof-of-concept has been identified at time of analysis; a vendor patch was released on 2026-06-25 in version 2026.5.2.

Technical ContextAI

Pretix is an open-source self-hosted event ticketing platform; pretix-mollie (CPE cpe:2.3:a:pretix:pretix-mollie:*:*:*:*:*:*:*:*) is its payment gateway integration for the Dutch payment service provider Mollie. The root cause is CWE-841 (Improper Enforcement of Behavioral Workflow): the plugin accepts Mollie's 'paid' status signal without verifying that the referenced payment ID or order token in the response cryptographically or referentially matches the specific pending order being confirmed. This allows the payment validation workflow to be driven out of the intended sequence - a confirmed payment for one order satisfies the payment gate for an entirely different order. The CVSS 4.0 vector (AV:N/AC:H/AT:P) reflects that exploitation requires a prior successful payment within the same system instance to harvest a usable status response.

RemediationAI

Upgrade pretix-mollie to version 2026.5.2, which addresses the improper payment status binding per the vendor release post at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. Until patching is possible, a targeted workaround is to temporarily disable the Mollie payment method in the Pretix admin panel and direct ticket purchasers to an alternative payment provider, accepting the trade-off of reduced payment options. A second compensating control is to implement post-sale order audit checks: cross-reference Mollie transaction IDs against issued tickets in the Pretix order backend and flag or revoke any ticket where the bound Mollie payment ID does not match the expected order reference. This manual review adds operational overhead but can detect abuse that has already occurred.