The vulnerability lies in a failure to properly validate payment status responses in the pretix-girosolution payment integration with GiroCheckout. An attacker can take a successful payment status from one transaction and supply it to the system for a different payment, thereby obtaining access to multiple valid tickets using only a single actual payment. This flaw allows an unauthorized user to claim tickets that were not legitimately purchased, compromising the integrity of the ticketing process.

The affected product is pretix-girosolution supplied by pretix GmbH. No specific versions were listed, so all releases prior to the 2026-6-1 update are potentially vulnerable. Users should verify that their installation is not running the outdated component.

The CVSS score of 6.3 indicates a moderate severity, but the EPSS score of less than 1% shows that the probability of exploitation is currently very low. The vulnerability is not listed in CISA's KEV catalog, further suggesting that no widespread exploitation is documented. The likely attack vector involves manipulating or forging payment status responses sent to the ticketing system; an attacker would need access to the payment status flow or the ability to replay or alter transaction data. If successful, the attacker could obtain multiple tickets without having paid for each individually, undermining the revenue model and trust in the system.