pretix has Broken Access Control Allowing Cross-User File Access via UUID
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-14882US | — | — | ||
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/advisories/GHSA-pmjj-h5jm-vxh4ADVISORY
- https://github.com/pretix/pretixPACKAGE
- https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479aWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-14882ADVISORY
- https://pretix.eu/about/en/blog/20251219-release-2025-10-1WEB
- https://pypi.org/project/pretixPACKAGE
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan