GHSA-r2h2-g46h-8mx8
NoneCVSS
—
EPSS
—
Published
Dec 19, 2025
CISA due date
—
The record
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pretix | 0 | 2025.8.3 |
| PyPI | pretix | 2025.10.0 | 2025.10.1 |
| PyPI | pretix | 2025.9.0 | 2025.9.3 |
| pypi | pretix | 2025.10.0 | No fix |
| pypi | pretix | 2025.9.0 | No fix |
Related vulnerabilities
- CVE-2025-14881 Multiple API endpoints allowed access to sensitive files from other users by knowing the… Same vulnerability
- GHSA-r8p8-qw9w-j9qv pretix unsafely evaluates variables in emails Also affects pretix
- CVE-2026-2415 Emails sent by pretix can utilize placeholders that will be filled with customer data. Also affects pretix
- GHSA-pmjj-h5jm-vxh4 pretix has Broken Access Control Allowing Cross-User File Access via UUID Also affects pretix
- CVE-2025-14882 An API endpoint allowed access to sensitive files from other users by knowing the UUID of… Also affects pretix
- CVE-2026-13319 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before… CWE-639
- CVE-2026-111767 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-639
- CVE-2026-105755 vLLM is an inference and serving engine for large language models. CWE-639