EUVD-2026-39468Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible room creation API requires authenticated low-privilege account; high complexity and prerequisites constrain exploitability; only limited integrity impact applies.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
2DescriptionCVE.org
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
AnalysisAI
Incorrect authorization logic during room creation in Venueless permits authenticated low-privilege users to create room types they are not permitted to create. The CVSS 4.0 score of 2.3 reflects the narrow, integrity-only impact and significant attack preconditions - requiring authentication, high complexity, and specific prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Venueless is an open-source virtual event platform developed by pretix (CPE: cpe:2.3:a:pretix:venueless). The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaws where server-side logic fails to correctly enforce access control based on user-supplied identifiers - in this case, the room type specified during a room creation request. The permission check is performed but evaluated incorrectly, meaning the enforcement boundary exists but is bypassable rather than absent entirely. This is a logic-level flaw in the room creation API pathway, not a missing authentication gate.
RemediationAI
Apply the patch referenced in GitHub Security Advisory GHSA-hj6j-wpgc-qrp5 (https://github.com/venueless/venueless/security/advisories/GHSA-hj6j-wpgc-qrp5). An exact fixed version number was not confirmed from the available data - review the advisory directly to identify the minimum safe release. As a compensating control prior to patching, administrators should audit and restrict which user roles are granted any room creation capability at all, reducing the set of accounts that could exploit the incorrect permission check. This mitigation may limit event host functionality as a side effect.
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Unvalidated redirect in Venueless social login allows phishing attacks by abusing the trusted domain reputation of legit
Formula injection in Venueless Excel exports allows an attacker with a low-privilege account to embed malicious spreadsh
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today