Executive brief
pretix has Broken Access Control Allowing Cross-User File Access via UUID
Affected products
- PyPI pretix
Junglewise Threat Intelligence
CVE-2025-14881: PYSEC-2026-1803 - pretix has Broken Access Control Allowing Cross-User File Access via UUID
CVE-2025-14881 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: pretix (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1802 - pretix has Broken Access Control Allowing Cross-User File Access via UUID
- PYSEC-2026-1801 - pretix allows Pillow to parse EPS files
- rami.io pretix authorization bypass in API export endpoint
- rami.io pretix data isolation breach in check-in API
- PYSEC-2026-110 - Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templat