This vulnerability occurs when room creation permissions are evaluated incorrectly, allowing an attacker to create rooms of types that should be restricted. The effect is a privilege escalation, enabling unauthorized configuration of rooms that may expose sensitive data or grant elevated capabilities. The flaw stems from improper authorization enforcement, identified as CWE-639.

The affected system is Pretix Venueless. No specific version range is listed in the advisory, so all deployments of Venueless may be vulnerable until a patch is applied.

The CVSS score of 2.3 indicates a low severity issue. Because no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation appears limited. The attack likely requires an authenticated user with access to the room‑creation interface; the attacker would need only to supply the appropriate parameters to create a prohibited room type.