Is there a patch available for EUVD-2026-39413?

Yes, a patch is available for EUVD-2026-39413. Update the affected software to the latest version immediately.

pretix-computop EUVD-2026-39413

Q: What is the CVSS score of EUVD-2026-39413?

EUVD-2026-39413 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-13223 MEDIUM

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-06-25 rami.io

GHSA-5qw6-59g4-vvqw

Information Disclosure Pretix Pretix Computop

6.3

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network-reachable replay attack with no privileges needed, but AC:H because attacker must first obtain a valid payment response; integrity-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 16:03 EUVD

Analysis Generated

Jun 25, 2026 - 15:18 vuln.today

DescriptionCVE.org

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

AnalysisAI

Payment response replay in the pretix-computop integration allows an unauthenticated network attacker to obtain multiple valid event tickets by paying only once. The Pretix Computop plugin fails to bind successful payment status responses to their originating transaction, so a response captured from a completed payment can be submitted against any other pending order. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified, though the vendor disclosed the issue alongside a fix on 2026-06-25.

Technical ContextAI

The affected component is the pretix-computop integration library (CPE: cpe:2.3:a:pretix:pretix-computop:*:*:*:*:*:*:*:*), which bridges the open-source Pretix event ticketing platform with the Computop payment service provider gateway. CWE-841 (Improper Enforcement of Behavioral Workflow) describes the root cause: the application fails to enforce that each step in the payment workflow - specifically the successful status response - is cryptographically or contextually bound to the originating order or transaction reference. Because the status callback is accepted without verifying its association with the specific payment it was issued for, the system cannot distinguish a legitimate response from a replayed one sourced from an unrelated transaction.

RemediationAI

Upgrade the pretix-computop plugin to the patched release documented in the vendor advisory at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/ - the URL slug indicates version 2026.5.2 released 2026-06-25, though the exact package version should be verified in the advisory. As a compensating control prior to patching, operators can temporarily disable Computop-based payment methods in the Pretix admin panel and redirect customers to alternative payment providers; this eliminates the attack surface entirely but disrupts Computop-dependent checkout flows. Additionally, reviewing recent orders for anomalous patterns - multiple successful ticket grants sharing identical payment reference or response tokens - may help identify whether the vulnerability was exploited prior to patching.