GitHub Advisoryadvisory · PyPI

GHSA-pmjj-h5jm-vxh4 pretix has Broken Access Control Allowing Cross-User File Access via UUID

LOW Published 2025-12-19 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-14882
Ecosystem
PyPI
Packages
pretix
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Weaknesses
CWE-639
Reviewed
2025-12-20

Affected packages

• PyPI pretix: >= 2025.10.0, < 2025.10.1 → fixed in 2025.10.1 • PyPI pretix: >= 2025.9.0, < 2025.9.3 → fixed in 2025.9.3 • PyPI pretix: < 2025.8.3 → fixed in 2025.8.3

Description

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Related

Alias · CVE (1)

  • CVE-2025-14882 An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References