CVE-2025-14881
NoneCVSS
—
EPSS
0.2%
Published
Dec 19, 2025
CISA due date
—
The record
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pretix | 0 | 2025.8.3 |
| PyPI | pretix | 2025.10.0 | 2025.10.1 |
| PyPI | pretix | 2025.9.0 | 2025.9.3 |
| pypi | pretix | 2025.10.0 | No fix |
| pypi | pretix | 2025.9.0 | No fix |
Related vulnerabilities
- GHSA-r2h2-g46h-8mx8 pretix has Broken Access Control Allowing Cross-User File Access via UUID Same vulnerability
- GHSA-r8p8-qw9w-j9qv pretix unsafely evaluates variables in emails Also affects pretix
- CVE-2026-2415 Emails sent by pretix can utilize placeholders that will be filled with customer data. Also affects pretix
- GHSA-pmjj-h5jm-vxh4 pretix has Broken Access Control Allowing Cross-User File Access via UUID Also affects pretix
- CVE-2025-14882 An API endpoint allowed access to sensitive files from other users by knowing the UUID of… Also affects pretix
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639