CVE-2026-125744
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-o
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026
Not enough EPSS history yet.
Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-only access to an event could use this to change the event's ticket layout.
No related CVEs by CWE or product.