{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://pypi.python.org","packageName":"pretix","product":"","source":"CNA: pretix","vendor":"pretix","versions":[{"lessThan":"2026.7.4","status":"affected","version":"0","versionType":"python"},{"lessThan":"2026.8.2","status":"affected","version":"2026.8.0","versionType":"python"},{"lessThan":"2026.9.1","status":"affected","version":"2026.9.0","versionType":"python"}]}],"cveId":"CVE-2026-125744","cwes":[],"description":"Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":1.2,"severity":"low","source":"CNA: pretix","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U","version":"4.0"}],"modifiedAt":1794315636147,"publishedAt":1794315636147,"references":[{"source":"CNA: pretix","tags":["vendor-advisory"],"url":"https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/"}],"remediation":[],"revision":"18f9d7c6b374d9f3f1624a139ea338df9e20001c5f2abcc7534628c11923307e","sources":[{"modifiedAt":1794315636147,"name":"CNA: pretix","retrievedAt":1794316404346,"url":"https://www.cve.org/CVERecord?id=CVE-2026-125744"}],"ssvc":null,"status":"published","title":"Missing permission check in ticket layout API","updatedAt":1794316404346}