Auth bypass in Pretix Venueless

CVE-2026-13350

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (6.7th percentile) — read the EPSS interpretation.