GHSA-pmjj-h5jm-vxh4

ghsaUSosv

pretix has Broken Access Control Allowing Cross-User File Access via UUID

view advisory published 2025-12-19Licence: CC-BY-4.0

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-14882US	—	0.25% (16th)	—	2025-12-19
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

references

External citations — patches, advisories, analysis.

https://github.com/pretix/pretixPACKAGE
https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479aWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-14882ADVISORY
https://pretix.eu/about/en/blog/20251219-release-2025-10-1WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan