Is there a patch available for EUVD-2026-39468?

Yes, a patch is available for EUVD-2026-39468. Update the affected software to the latest version immediately.

Venueless EUVD-2026-39468

Q: What is the CVSS score of EUVD-2026-39468?

EUVD-2026-39468 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-13350 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-25 rami.io

Authentication Bypass Pretix Venueless

2.3

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.1 LOW

Network-accessible room creation API requires authenticated low-privilege account; high complexity and prerequisites constrain exploitability; only limited integrity impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:22 vuln.today

DescriptionCVE.org

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.

AnalysisAI

Incorrect authorization logic during room creation in Venueless permits authenticated low-privilege users to create room types they are not permitted to create. The CVSS 4.0 score of 2.3 reflects the narrow, integrity-only impact and significant attack preconditions - requiring authentication, high complexity, and specific prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Venueless is an open-source virtual event platform developed by pretix (CPE: cpe:2.3:a:pretix:venueless). The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a class of flaws where server-side logic fails to correctly enforce access control based on user-supplied identifiers - in this case, the room type specified during a room creation request. The permission check is performed but evaluated incorrectly, meaning the enforcement boundary exists but is bypassable rather than absent entirely. This is a logic-level flaw in the room creation API pathway, not a missing authentication gate.

RemediationAI

Apply the patch referenced in GitHub Security Advisory GHSA-hj6j-wpgc-qrp5 (https://github.com/venueless/venueless/security/advisories/GHSA-hj6j-wpgc-qrp5). An exact fixed version number was not confirmed from the available data - review the advisory directly to identify the minimum safe release. As a compensating control prior to patching, administrators should audit and restrict which user roles are granted any room creation capability at all, reducing the set of accounts that could exploit the incorrect permission check. This mitigation may limit event host functionality as a side effect.