Description
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pretix | pretix | < 2026.7.4, 2026.8.0 – < 2026.8.2, 2026.9.0 – < 2026.9.1 | 2026.7.4 |
References
- https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/ vendor-advisory