A crafted link can cause a victim to be logged into an attacker’s customer account, allowing the attacker to place orders and have the victim’s payment details stored in that account. The flaw is a session fixation weakness (CWE‑384) that can lead to disclosure of order information but does not provide broader system access.

The vulnerability affects the pretix event ticketing platform. No specific version range is listed; any deployment of pretix that allows separate event and organizer domains may be impacted.

The CVSS score of 1.7 reflects a very low severity. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The attack requires a victim to click a malicious link and only succeeds when the event is hosted on a different domain than the organizer page, making it a limited and user‑interaction–dependent risk.