From e243667c621ae483806aad0d305b04db8e9c1c6c Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Tue, 10 Nov 2026 13:13:31 +0100
Subject: [PATCH 1/2] [SECURITY] Fix missing permission check for ticket layout
 API (CVE-2026-125744)

---
 src/pretix/plugins/ticketoutputpdf/api.py     |  1 +
 src/tests/plugins/ticketoutputpdf/test_api.py | 19 +++++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/src/pretix/plugins/ticketoutputpdf/api.py b/src/pretix/plugins/ticketoutputpdf/api.py
index 23c5bc54d..525f30b55 100644
--- a/src/pretix/plugins/ticketoutputpdf/api.py
+++ b/src/pretix/plugins/ticketoutputpdf/api.py
@@ -111,6 +111,7 @@ class TicketLayoutViewSet(viewsets.ModelViewSet):
     serializer_class = TicketLayoutSerializer
     queryset = TicketLayout.objects.none()
     lookup_field = 'id'
+    write_permission = 'event.settings.general:write'
 
     def get_queryset(self):
         return self.request.event.ticket_layouts.all()
diff --git a/src/tests/plugins/ticketoutputpdf/test_api.py b/src/tests/plugins/ticketoutputpdf/test_api.py
index e0e8b3d6a..b94f25e02 100644
--- a/src/tests/plugins/ticketoutputpdf/test_api.py
+++ b/src/tests/plugins/ticketoutputpdf/test_api.py
@@ -327,3 +327,22 @@ def test_renderer_batch_invalid(env, token_client, position):
     )
     assert resp.status_code == 400
     assert resp.data == {"parts": ["Please do not submit more than 1000 parts."]}
+
+
+@pytest.mark.django_db
+def test_api_permission(env, token_client):
+    t = env[0].organizer.teams.get()
+    t.limit_event_permissions = {"event.orders:read": True}
+    t.all_event_permissions = False
+    t.save()
+    resp = token_client.patch(
+        '/api/v1/organizers/{}/events/{}/ticketlayouts/{}/'.format(env[0].slug, env[0].slug, env[1].pk),
+        {
+            "name": "Bar",
+            "layout": [
+                {"type": "barcodearea", "left": "7.00", "bottom": "11.15", "size": "45.00", "content": "secret"}
+            ]
+        },
+        format='json'
+    )
+    assert resp.status_code == 403
-- 
2.54.0


From 8eadb3b1c4b1b2bcaa7c8ade0a813d1761ab8e79 Mon Sep 17 00:00:00 2001
From: Raphael Michel <michel@rami.io>
Date: Tue, 10 Nov 2026 13:56:07 +0100
Subject: [PATCH 2/2] Bump to 2026.9.1

---
 src/pretix/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pretix/__init__.py b/src/pretix/__init__.py
index b07adf9e8..80da1878b 100644
--- a/src/pretix/__init__.py
+++ b/src/pretix/__init__.py
@@ -19,4 +19,4 @@
 # You should have received a copy of the GNU Affero General Public License along with this program.  If not, see
 # <https://www.gnu.org/licenses/>.
 #
-__version__ = "2026.9.0"
+__version__ = "2026.9.1"
-- 
2.54.0