CVE-2026-13602: rami.io pretix privilege escalation via session parameter injection

CVE-2026-13602 · Severity: info · CVSS 7.7 · Published 2026-07-01

A vulnerability in the pretix ticketing system allows an attacker with limited access to take over any other user account, including administrator accounts. By exploiting a chain of weaknesses in how the system signs and validates web sessions, an attacker can impersonate other users and gain full access to sensitive event data and financial settings. This could lead to a total compromise of the ticketing platform's operations and customer data.

Technologies: Rami.Io Pretix. Vendors: Rami.Io.

Quick answers

Is CVE-2026-13602 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13602 being exploited in the wild.
How severe is CVE-2026-13602?
Informational severity, with a CVSS score of 7.7, published 1 July 2026.
Which products and versions are affected?
Rami.Io Pretix 4.14.0 through 2026.3.4, 2026.4.0 through 2026.4.4, 2026.5.0 through 2026.5.2; Rami.Io Pretix-Bitpay < 1.5.3; Rami.Io Pretix-Payone < 1.4.3; Rami.Io Pretix-Saferpay < 1.6.3; and 2 more.
Is there a fix for CVE-2026-13602?
A patch was published on 2026-07-01: Fixed in pretix 2026.5.3, 2026.4.5, and 2026.3.5.post1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13602 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-13602?
Check whether you run Rami.Io Pretix, Rami.Io Pretix-Bitpay, Rami.Io Pretix-Payone or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a chain of three distinct weaknesses. First, multiple payment plugins (e.g., Stripe, Mollie) transport session parameters via signed URL parameters without validating the scope of those parameters. Second, the core system's Referer-obfuscating redirect feature uses the same cryptographic key and salt as the payment plugins, allowing an attacker with event access to generate validly signed arbitrary content. Third, the administrative 'impersonate' feature relied on session parameters that could be guessed (user IDs). By combining these, an attacker can inject a signed 'impersonate' parameter into their session to become any user. The fix introduces strict parameter validation, unique salts for different features, and unguessable session tokens for impersonation.

Affected products

  • rami.io pretix 4.14.0 through 2026.3.4, 2026.4.0 through 2026.4.4, 2026.5.0 through 2026.5.2
  • rami.io pretix-mollie < 2.5.7
  • rami.io pretix-oppwa < 1.4.4
  • rami.io pretix-bitpay < 1.5.3
  • rami.io pretix-payone < 1.4.3
  • rami.io pretix-secuconnect < 1.0.4
  • rami.io pretix-sofort < 1.4.2
  • rami.io pretix-saferpay < 1.6.3

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: patched: Fixed in pretix 2026.5.3, 2026.4.5, and 2026.3.5.post1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.