EUVD-2026-39415
GHSA-x2gq-qh4v-9777
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, high complexity requiring a prior valid payment; no privileges, no user interaction; only low integrity impact via fraudulent ticket issuance.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
AnalysisAI
Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusing a single legitimate Mollie payment confirmation. The plugin fails to bind payment status responses to their originating transaction, so a successful payment callback for order A can be submitted against order B. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Pretix instance has the pretix-mollie plugin installed and an active Mollie payment method enabled in the event configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.3 with High Attack Complexity and Attack Target: Present (AT:P) accurately reflects the preconditions: the attacker must first complete one legitimate payment to obtain a valid status response, then replay it against a second order, which requires precise timing and knowledge of the order identifier scheme. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker purchases one low-value ticket, completing a genuine Mollie payment and capturing the resulting 'paid' status callback. The attacker then initiates checkout for additional tickets in separate orders but, instead of completing those payments, injects the previously captured successful payment status response into the payment confirmation endpoint for each new order. … |
| Remediation | Upgrade pretix-mollie to version 2026.5.2, which addresses the improper payment status binding per the vendor release post at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Pretix Mollie
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today