GHSA-r2h2-g46h-8mx8

pretix has Broken Access Control Allowing Cross-User File Access via UUID

Source: GitHub Advisory Database (reviewed) Low CVE-2025-14881

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pretix	>= 2025.10.0, < 2025.10.1	2025.10.1
PyPI	pretix	>= 2025.9.0, < 2025.9.3	2025.9.3
PyPI	pretix	< 2025.8.3	2025.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-14881 advisory
https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a web
https://github.com/pretix/pretix package
https://pretix.eu/about/en/blog/20251219-release-2025-10-1 web