pretix has Broken Access Control Allowing Cross-User File Access via UUID
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-14881US | — | — | ||
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-r2h2-g46h-8mx8ADVISORY
- https://github.com/pretix/pretixPACKAGE
- https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479aWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-14881ADVISORY
- https://pretix.eu/about/en/blog/20251219-release-2025-10-1WEB
- https://pypi.org/project/pretixPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan