# CVE-2026-13350: Pretix Venueless authorization bypass in room creation

Source: https://junglewise.ai/threats/cve-2026-13350-pretix-venueless-authorization-bypass-in-room-creation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-13350 · Severity: info · CVSS 2.3 · Published 2026-06-25

Venueless, a virtual event platform, contains a flaw in how it validates user permissions during the creation of virtual rooms. An authorized user could exploit this to create specific types of rooms that they should not have the authority to manage. This could lead to unauthorized use of platform features or organizational inconsistencies during a virtual event.

## Quick answers

**Is CVE-2026-13350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13350 being exploited in the wild.

**How severe is CVE-2026-13350?** Informational severity, with a CVSS score of 2.3, published 25 June 2026.

**Which products and versions are affected?** pretix / rami.io Venueless < 040ae040 (git).

**Is there a fix for CVE-2026-13350?** A patch was published on 2026-06-25. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13350 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13350?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability (CWE-639) exists in Venueless due to incorrect permission validation during the room creation process. A remote attacker with low-level authenticated privileges can bypass intended restrictions to create room types that should be restricted to higher-privileged roles. The attack requires specific conditions (Attack Requirements: Present) and has high complexity, but it allows for unauthorized modification of system state (Integrity: Low). The issue is addressed in git commit 040ae040.

## Affected products

- pretix / rami.io Venueless < 040ae040 (git)

## Timeline

- 2026-06-25: disclosed
- 2026-06-25: advisory
- 2026-06-25: patched

## References

- [https://github.com/venueless/venueless/security/advisories/GHSA-hj6j-wpgc-qrp5](https://github.com/venueless/venueless/security/advisories/GHSA-hj6j-wpgc-qrp5)