CVE-2026-125744 - Vulnerability Details - OpenCVE

Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pretix

unaffected

Version	Status	Constraints
`0`	affected	< 2026.7.4
`2026.8.0`	affected	< 2026.8.2
`2026.9.0`	affected	< 2026.9.1

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/

History

Tue, 10 Nov 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
Title		Missing permission check in ticket layout API
References		https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/
Metrics		cvssV4_0 `{'score': 1.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: pretix

Published: 2026-11-10T13:00:36.147Z

Updated: 2026-11-10T13:00:36.147Z

Reserved: 2026-11-10T12:13:22.604Z

Link: CVE-2026-125744

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-10T13:18:22.890

Modified: 2026-11-10T13:18:22.890

Link: CVE-2026-125744

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-125744", "assignerOrgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "state": "PUBLISHED", "assignerShortName": "pretix", "dateReserved": "2026-11-10T12:13:22.604Z", "datePublished": "2026-11-10T13:00:36.147Z", "dateUpdated": "2026-11-10T13:00:36.147Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "shortName": "pretix", "dateUpdated": "2026-11-10T13:00:36.147Z"}, "title": "Missing permission check in ticket layout API", "affected": [{"vendor": "pretix", "collectionURL": "https://pypi.python.org", "packageName": "pretix", "repo": "https://github.com/pretix/pretix", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.7.4", "versionType": "python"}, {"status": "affected", "version": "2026.8.0", "lessThan": "2026.8.2", "versionType": "python"}, {"status": "affected", "version": "2026.9.0", "lessThan": "2026.9.1", "versionType": "python"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout."}]}], "references": [{"url": "https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 1.2, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}}], "credits": [{"lang": "en", "value": "Immanuel Tikhonov", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "pretix", "repo": "https://github.com/pretix/pretix", "vendor": "pretix", "versions": [{"lessThan": "2026.7.4", "status": "affected", "version": "0", "versionType": "python"}, {"lessThan": "2026.8.2", "status": "affected", "version": "2026.8.0", "versionType": "python"}, {"lessThan": "2026.9.1", "status": "affected", "version": "2026.9.0", "versionType": "python"}]}], "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout."}], "id": "CVE-2026-125744", "lastModified": "2026-11-10T13:18:22.890", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.2, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "type": "Secondary"}]}, "published": "2026-11-10T13:18:22.890", "references": [{"source": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "url": "https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/"}], "sourceIdentifier": "655498c3-6ec5-4f0b-aea6-853b334d05a6", "vulnStatus": "Received"}