{"id":"CVE-2025-14882","aliases":["GHSA-pmjj-h5jm-vxh4","PYSEC-2026-1802"],"title":"pretix has Broken Access Control Allowing Cross-User File Access via UUID","summary":"pretix has Broken Access Control Allowing Cross-User File Access via UUID","severity":"low","vendor":"pretix","product":"pretix","ecosystem":"pip","affected":["pretix >= 2025.10.0, < 2025.10.1","pretix >= 2025.9.0, < 2025.9.3","pretix < 2025.8.3"],"patched":["pretix 2025.10.1","pretix 2025.9.3","pretix 2025.8.3"],"published":"2025-12-19","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pmjj-h5jm-vxh4","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14882"},{"url":"https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a"},{"url":"https://github.com/pretix/pretix"},{"url":"https://pretix.eu/about/en/blog/20251219-release-2025-10-1"}],"tags":["osv","pip"],"epss":0.00248,"epssPercentile":0.14278,"ingestedAt":"2026-07-08T18:25:51.796Z","slug":"CVE-2025-14882","body":"## Overview\n\nAn API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.\n\n## Affected packages\n\n- `pretix >= 2025.10.0, < 2025.10.1`\n- `pretix >= 2025.9.0, < 2025.9.3`\n- `pretix < 2025.8.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pretix 2025.10.1`\n- `pretix 2025.9.3`\n- `pretix 2025.8.3`","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}