CVE-2025-14882
pretix has Broken Access Control Allowing Cross-User File Access via UUID
EPSS 0.06%
Description
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
How to fix CVE-2025-14882
To remediate CVE-2025-14882, upgrade the affected package to a fixed version below.
- PyPI/pretix—upgrade to 2025.10.1 or later
Is CVE-2025-14882 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2025.10.0, < 2025.10.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U |