CVE-2026-18029 Overview
CVE-2026-18029 is a business logic vulnerability in Pretix's payment integration with GiroCheckout. The integration does not properly validate the correlation between a payment status response and the specific payment it belongs to. An attacker can replay a successful payment status response from one legitimate payment and submit it against a different, unpaid order. This allows the attacker to obtain multiple valid tickets while paying only once. The flaw is classified under CWE-841: Improper Enforcement of Behavioral Workflow.
Critical Impact
Attackers can obtain multiple valid tickets from a single legitimate payment by replaying payment status responses across unrelated orders.
Affected Products
- Pretix ticketing platform versions prior to 2026.6.1
- Deployments configured with the GiroCheckout payment provider integration
- Self-hosted and hosted Pretix instances processing GiroCheckout transactions
Discovery Timeline
- 2026-07-28 - CVE-2026-18029 published to NVD
- 2026-07-28 - Pretix releases version 2026.6.1 containing the fix (Pretix Release Announcement)
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-18029
Vulnerability Analysis
The vulnerability is a business logic flaw in the payment confirmation workflow between Pretix and GiroCheckout. When GiroCheckout returns a payment status response, Pretix accepts the response as proof of payment without verifying that the response corresponds to the specific order or transaction identifier being processed. This missing binding between response and order breaks the intended purchase workflow. An attacker who completes one valid payment obtains a signed or otherwise trusted "successful" status message. That same message can then be submitted to Pretix to mark additional, unrelated orders as paid. The result is order fulfillment without a matching financial transaction. The issue is classified as [CWE-841], indicating that a required step in the workflow (validating that the payment status references the correct payment) is either missing or incorrectly enforced.
Root Cause
The root cause is missing enforcement of a one-to-one relationship between a GiroCheckout payment status response and the Pretix order it settles. The integration trusts the presence of a success status rather than verifying transaction identifiers, amounts, and order references atomically against the originating payment record.
Attack Vector
Exploitation requires network access to the Pretix payment endpoints and possession of a valid GiroCheckout success response. The attacker performs one legitimate purchase to acquire that response, then replays or resubmits the status data to confirm additional orders. Attack complexity is elevated because the attacker must understand the callback mechanics and the format of GiroCheckout responses. Refer to the Pretix Release Announcement for vendor technical details.
Detection Methods for CVE-2026-18029
Indicators of Compromise
- Multiple Pretix orders marked as paid that reference the same GiroCheckout transaction identifier
- Orders transitioned to a paid state without a corresponding settlement entry in GiroCheckout reconciliation reports
- A mismatch between the number of issued tickets and the number of successful GiroCheckout transactions for a given event
Detection Strategies
- Reconcile Pretix order records against GiroCheckout settlement exports and flag any order whose transaction identifier appears more than once
- Review web server and application logs for repeated POST requests to the GiroCheckout return or notify endpoints carrying identical transaction parameters
- Alert on orders that move to the paid state within an unusually short window after another order using the same payment reference
Monitoring Recommendations
- Enable verbose logging on the payment callback handler and retain logs long enough to support post-event reconciliation
- Monitor for unusual spikes in ticket issuance that are not matched by equivalent volume in GiroCheckout settlement data
- Configure alerts on duplicate transaction identifiers observed across distinct order IDs
How to Mitigate CVE-2026-18029
Immediate Actions Required
- Upgrade Pretix to version 2026.6.1 or later, which contains the corrected GiroCheckout payment validation logic
- Audit historical orders processed through GiroCheckout since the integration was enabled and identify any transactions with reused identifiers
- Contact GiroCheckout to obtain settlement data for reconciliation against internal Pretix order records
Patch Information
Pretix addressed CVE-2026-18029 in release 2026.6.1, published on 2026-07-28. The fix enforces validation that a GiroCheckout payment status response is bound to the specific order and transaction it references. Details are available in the Pretix Release Announcement.
Workarounds
- Temporarily disable the GiroCheckout payment method in Pretix until the upgrade to 2026.6.1 is applied
- Require manual reconciliation and confirmation of GiroCheckout payments before releasing tickets for high-value events
- Restrict access to payment callback endpoints where feasible and monitor them closely for anomalous replay patterns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
