pretix-mollie CVE-2026-57536

Exploitation requires that the target Pretix instance has the pretix-mollie plugin installed and an active Mollie payment method enabled in the event configuration. The attacker must first successfully complete at least one real Mollie payment on the same pretix-mollie deployment to obtain a valid 'paid' status response for replay. Knowledge of or the ability to enumerate pending order identifiers on the target instance is also necessary to redirect the replayed status to additional orders. Exploitation is limited to the Mollie payment gateway path specifically; other payment integrations are not affected. There is no authentication requirement to trigger the payment callback endpoint itself, but a prior completed payment on the same instance is an absolute prerequisite.

The CVSS base score of 6.3 with High Attack Complexity and Attack Target: Present (AT:P) accurately reflects the preconditions: the attacker must first complete one legitimate payment to obtain a valid status response, then replay it against a second order, which requires precise timing and knowledge of the order identifier scheme. Despite PR:N (no account privilege required), the actual operational bar is non-trivial. EPSS data was not provided; without it, exploitation probability cannot be quantified, but the limited deployment footprint of pretix-mollie and the requirement for a real preceding payment reduce realistic mass-exploitation risk significantly. There is no KEV listing and no public PoC, making this a medium-priority remediation rather than an emergency response. The financial integrity impact is real - fraudulent ticket issuance results in direct revenue loss for event organizers - but availability and confidentiality are unaffected. CVSS integrity impact is rated Low on both the vulnerable and subsequent system, which is consistent with a business-logic bypass rather than arbitrary data modification.

An attacker purchases one low-value ticket, completing a genuine Mollie payment and capturing the resulting 'paid' status callback. The attacker then initiates checkout for additional tickets in separate orders but, instead of completing those payments, injects the previously captured successful payment status response into the payment confirmation endpoint for each new order. The pretix-mollie plugin accepts the replayed status without verifying the payment-to-order binding, issuing valid tickets for all targeted orders while only one payment was processed.