Description
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Published: 2025-12-19
Score: 3.8 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-pmjj-h5jm-vxh4 pretix has Broken Access Control Allowing Cross-User File Access via UUID
History

Sun, 21 Dec 2025 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Pretix
Pretix pretix
Vendors & Products Pretix
Pretix pretix

Fri, 19 Dec 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 19 Dec 2025 12:45:00 +0000

Type Values Removed Values Added
Description An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Title Insecure direct object reference
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 3.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U'}

Subscriptions

Pretix Pretix
cve-icon MITRE

Status: PUBLISHED

Assigner: rami.io

Published:

Updated: 2025-12-19T13:50:26.039Z

Reserved: 2025-12-18T11:52:58.280Z

Link: CVE-2025-14882

cve-icon Vulnrichment

Updated: 2025-12-19T13:50:18.732Z

cve-icon NVD

Status : Deferred

Published: 2025-12-19T13:16:02.993

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-14882

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-12-21T21:12:58Z

Weaknesses