CVE-2026-125744: Missing permission check in ticket layout API
Published Nov 10, 2026
·Updated
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
Event History
Nov 10, 2026
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
Description
Frequently Asked Questions
1
What level of access would an attacker need to make unauthorized changes?
An attacker would need read-only access to the affected event, using either a user account or an API token. That access could then be used to change the event's ticket layout.