CVE-2025-14881
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
- CVSS 4.0
- 3.8
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r2h2-g46h-8mx8 | PyPI | pretix | >=2025.10.0 <2025.10.1 | 2025.10.1 |
| GHSA-r2h2-g46h-8mx8 | PyPI | pretix | >=2025.9.0 <2025.9.3 | 2025.9.3 |
| GHSA-r2h2-g46h-8mx8 | PyPI | pretix | <2025.8.3 | 2025.8.3 |
| PYSEC-2026-1803 | PyPI | pretix | <2025.8.3 >=2025.9.0 <2025.9.3 >=2025.10.0 <2025.10.1 | 2025.8.3, 2025.9.3, 2025.10.1 |