CVE-2026-57536: Pretix Pretix-Mollie

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

Affected products

• Pretix Pretix-Mollie: before 2.5.6 (fixed in 2.5.6)

Published 2026-06-25. Last modified 2026-06-25.