CVE-2026-13222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13222", "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "state": "PUBLISHED", "assignerShortName": "rami.io", "dateReserved": "2026-06-24T16:01:13.668Z", "datePublished": "2026-06-25T14:07:03.521Z", "dateUpdated": "2026-06-25T15:13:53.504Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "shortName": "rami.io", "dateUpdated": "2026-06-25T14:16:55.922Z"}, "title": "Insufficient validation of payment status in pretix-oppwa", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-841", "description": "CWE-841 Improper enforcement of behavioral workflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "affected": [{"vendor": "pretix", "product": "pretix-oppwa", "collectionURL": "https://pypi.python.org", "packageName": "pretix-oppw", "repo": "https://github.com/pretix/pretix-oppwa", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.3", "versionType": "python"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Our payment integration with Oppwa-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Our payment integration with Oppwa-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment."}]}], "references": [{"url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}}], "credits": [{"lang": "en", "value": "Deepjyoti Roy", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-25T15:13:47.859125Z", "id": "CVE-2026-13222", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T15:13:53.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T15:13:47.859125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-25T15:13:50.012Z"}}], "cna": {"title": "Insufficient validation of payment status in pretix-oppwa", "credits": [{"lang": "en", "type": "finder", "value": "Deepjyoti Roy"}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21 Exploitation of Trusted Identifiers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/pretix/pretix-oppwa", "vendor": "pretix", "product": "pretix-oppwa", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.3", "versionType": "python"}], "packageName": "pretix-oppw", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2/"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "Our payment integration with Oppwa-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment.", "supportingMedia": [{"type": "text/html", "value": "Our payment integration with Oppwa-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-841", "description": "CWE-841 Improper enforcement of behavioral workflow"}]}], "providerMetadata": {"orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "shortName": "rami.io", "dateUpdated": "2026-06-25T14:16:55.922Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13222", "state": "PUBLISHED", "dateUpdated": "2026-06-25T15:13:53.504Z", "dateReserved": "2026-06-24T16:01:13.668Z", "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "datePublished": "2026-06-25T14:07:03.521Z", "assignerShortName": "rami.io"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "pretix-oppw", "product": "pretix-oppwa", "repo": "https://github.com/pretix/pretix-oppwa", "vendor": "pretix", "versions": [{"lessThan": "1.4.3", "status": "affected", "version": "0", "versionType": "python"}]}], "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Our payment integration with Oppwa-based payment methods did not \nproperly validate payment status responses. An attacker could use a \nsuccessful payment status response from one payment and supply it to the\n system for a different payment, gaining access to multiple valid \ntickets with only one payment."}, {"lang": "es", "value": "Nuestra integraci\u00f3n de pagos con m\u00e9todos de pago basados en Oppwa no validaba correctamente las respuestas de estado de pago. Un atacante podr\u00eda usar una respuesta de estado de pago exitosa de un pago y proporcionarla al sistema para un pago diferente, obteniendo acceso a m\u00faltiples entradas v\u00e1lidas con un solo pago."}], "id": "CVE-2026-13222", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13222", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-25T15:13:47.859125Z", "version": "2.0.3"}}]}, "published": "2026-06-25T15:16:34.150", "references": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "url": "https://pretix.eu/about/en/blog/20260625-release-2026-5-2/"}], "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-841"}], "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "pretix-oppwa", "vendor": "pretix"}], "created": "2026-06-25T15:30:16.570008+00:00", "updated": "2026-06-26T09:37:37.152665+00:00", "vendors": ["pretix", "pretix$PRODUCT$pretix-oppwa"]}