Executive brief
pretix is an open-source ticketing and event management platform. A security flaw in its API could allow an authenticated user to download files belonging to other users if they can obtain or guess the unique identifier (UUID) for those files. While the identifiers are long and random, making them difficult to guess, a successful exploit could lead to the unauthorized exposure of exported event data or internal documents.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in a pretix API endpoint responsible for file downloads. While pretix uses long, random UUIDs to identify export jobs and temporary files, one specific endpoint failed to verify if the requesting user had the appropriate permissions to access the file associated with a given UUID. An attacker with low privileges (authenticated user) could potentially download sensitive exports or internal files if they obtain a valid UUID, for example through log access or other information leaks. The issue is mitigated by the high entropy of the UUIDs, making brute-force attacks impractical. The vulnerability is fixed in versions 2026.4.2, 2026.3.2, and 2026.2.2.
Affected products
- rami.io pretix >= 2024.10.0, < 2026.4.2 (excluding 2026.2.2 and 2026.3.2)
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched