{"id":"CVE-2026-125744","kind":"vulnerability","aliases":["CVE-2026-125744"],"related":[],"title":"Ticketing platform: API lets read-only users change event ticket layouts","description":"Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.","summary":"The API endpoint that changes an event's ticket layout did not check whether the caller had write permission. An attacker with only read-only access to an event can change its ticket layout.","severity":"low","cvss":1.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api","other","self-hosted","ticketing"],"not_affected_if":["no-read-only-api-tokens"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","triaged_at":"2026-11-10T13:23:34+00:00","updated_at":"2026-11-10T13:23:34+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-10T13:23:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ticketing platform: API lets read-only users change event ticket layouts","impact":"low","summary":"The API endpoint that changes an event's ticket layout did not check whether the caller had write permission. An attacker with only read-only access to an event can change its ticket layout.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ticketing","api","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"yes","worst_case":"read-only account changes event ticket layouts","analyst_note":"Identify the affected ticketing product and its fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125744.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-read-only-api-tokens"],"who_is_affected":"Organizers who run the affected ticketing software and expose its API to staff or API tokens with read-only access to events. Installations where API tokens are limited to full write access, or where no read-only tokens exist, are less exposed. The sources do not name the product or its versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00067,"input_tokens":4508,"output_tokens":438,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-125744':15A,18A '-2026':14A,17A 'access':51B,85C 'api':3A,19B,26B,61C,77C 'attack':45B,80C 'caller':40B 'chang':9A,29B,56B,64C,93C 'check':37B,70C 'could':89C 'cve':13A,16A 'endpoint':27B,62C 'event':10A,31B,54B,88C,95C 'host':23B 'layout':12A,34B,59B,66C,98C 'let':4A 'permiss':43B,71C 'platform':2A 'proper':69C 'read':6A,49B,83C 'read-on':5A,48B,82C 'request':74C 'self':22B 'self-host':21B 'ticket':1A,11A,24B,33B,58B,65C,97C 'token':78C 'use':90C 'user':8A,75C 'whether':38B 'write':42B","nicknames":[],"mitigations":[],"who_affected":"Organizers who run the affected ticketing software and expose its API to staff or API tokens with read-only access to events. Installations where API tokens are limited to full write access, or where no read-only tokens exist, are less exposed. The sources do not name the product or its versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["api","low","other","selfhosted","ticketing"],"campaign_type":null,"search_a":"'-125744':15A,18A '-2026':14A,17A 'api':3A 'chang':9A 'cve':13A,16A 'event':10A 'layout':12A 'let':4A 'platform':2A 'read':6A 'read-on':5A 'ticket':1A,11A 'user':8A","search_b":"'access':51B 'api':19B,26B 'attack':45B 'caller':40B 'chang':29B,56B 'check':37B 'endpoint':27B 'event':31B,54B 'host':23B 'layout':34B,59B 'permiss':43B 'read':49B 'read-on':48B 'self':22B 'self-host':21B 'ticket':24B,33B,58B 'whether':38B 'write':42B","search_c":"'access':85C 'api':61C,77C 'attack':80C 'chang':64C,93C 'check':70C 'could':89C 'endpoint':62C 'event':88C,95C 'layout':66C,98C 'permiss':71C 'proper':69C 'read':83C 'read-on':82C 'request':74C 'ticket':65C,97C 'token':78C 'use':90C 'user':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T13:18:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"655498c3-6ec5-4f0b-aea6-853b334d05a6","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125744","severity":null,"published_at":"2026-11-10T13:18:22+00:00","modified_at":"2026-11-10T13:18:22+00:00","first_seen_at":"2026-11-10T13:22:03+00:00","fetched_at":"2026-11-10T13:22:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}