Auth bypass in Pretix Venueless

CVE-2026-13350

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

Vulnerability class: IDOR (Insecure Direct Object Reference)