CVE-2026-13223 describes a CWE-841 vulnerability in pretix-computop where the system does not properly enforce behavioral workflow by failing to validate payment status responses correctly. This flaw enables an attacker to reuse a successful payment status response from one payment to the system for a different payment, thereby obtaining multiple valid tickets from a single payment. The vulnerability affects pretix-computop versions before 1.3.2. There is no official remediation level or patch information provided in the available data.

The vulnerability allows an attacker to bypass payment validation controls, potentially gaining multiple valid tickets from a single payment transaction. This could lead to financial loss for ticket sellers and unauthorized access to events or services tied to these tickets. The CVSS 4.0 score of 6.3 indicates a medium severity impact with network attack vector, high attack complexity, and limited impact on confidentiality and integrity but some impact on system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor pretix vendor communications for updates. Until a fix is available, consider implementing additional manual verification of payment status responses or restricting reuse of payment tokens if possible.