This vulnerability in pretix Venueless arises from improper permission checks during the creation of rooms. Attackers with limited privileges can bypass authorization controls to create unauthorized room types. The issue is identified as CWE-639, which involves authorization bypass through user-controlled keys. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial privileges required, no user interaction, and low impact on integrity and availability. No vendor advisory or patch information is available, and the affected version is listed as =0.0.0, which likely indicates an initial or placeholder version identifier.

An attacker with limited privileges can create room types they are not authorized to create, potentially leading to unauthorized resource allocation or configuration within the Venueless platform. The overall impact is low severity as per the CVSS score, with limited integrity and availability impact and no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges to trusted users only and monitor for unusual room creation activities if possible.