low3.8
CVE-2025-14882
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Impact
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pretix | >= 2025.10.0, < 2025.10.1 | 2025.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://pretix.eu/about/en/blog/20251218-release-2025-10-1/
- https://github.com/advisories/GHSA-pmjj-h5jm-vxh4
- https://nvd.nist.gov/vuln/detail/CVE-2025-14882
- https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a
- https://pretix.eu/about/en/blog/20251219-release-2025-10-1