CVE-2026-125744 · Other
NO FIX YET
The API endpoint that changes an event's ticket layout did not check whether the caller had write permission. An attacker with only read-only access to an event can change its ticket layout.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizers who run the affected ticketing software and expose its API to staff or API tokens with read-only access to events. Installations where API tokens are limited to full write access, or where no read-only tokens exist, are less exposed. The sources do not name the product or its versions.
Not affected if no-read-only-api-tokens
Who cares api, self-hosted, ticketing
Unknown from the sources.
No fix yet, per the sources.
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.