{"id":"CVE-2026-125744","published":"2026-11-10T13:18:22.890","lastModified":"2026-11-10T13:18:22.890","description":"Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://pretix.eu/about/en/blog/20261110-release-2026-9-1-adyen/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}