GitHub Advisoryadvisory · PyPI

GHSA-r2h2-g46h-8mx8 pretix has Broken Access Control Allowing Cross-User File Access via UUID

LOW Published 2025-12-19 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-14881
Ecosystem
PyPI
Packages
pretix
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Weaknesses
CWE-639
Reviewed
2025-12-20

Affected packages

• PyPI pretix: >= 2025.10.0, < 2025.10.1 → fixed in 2025.10.1 • PyPI pretix: >= 2025.9.0, < 2025.9.3 → fixed in 2025.9.3 • PyPI pretix: < 2025.8.3 → fixed in 2025.8.3

Description

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Related

Alias · CVE (1)

  • CVE-2025-14881 Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References