CVE-2025-14881: 
Python vulnerability analysis and mitigation

CVE-2025-14881 is a Broken Access Control vulnerability in pretix, an open-source ticketing software, that allows low-privileged authenticated users to access sensitive files belonging to other users by knowing the UUID of the file. The flaw affects pretix versions prior to 2025.8.3, 2025.9.0–2025.9.2, and 2025.10.0. It was published on December 19, 2025, with a patch released the same day. The vulnerability carries a CVSS v4.0 base score of 3.8 (Low) (GitHub Advisory, ENISA EUVD).

The root cause is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key (CWE-639), where multiple API endpoints failed to enforce proper ownership checks before serving files. An attacker with a low-privilege account can supply a known or guessed UUID in API requests to retrieve files that belong to other users, bypassing the intended access controls. The attack requires network access and low-level privileges, but no user interaction, and the attack requirements note that some preconditions must be present (AT:P). A fix was committed in the pretix repository (commit 4b56518) (GitHub Advisory, pretix Blog).

Successful exploitation allows a low-privileged attacker to read sensitive files uploaded by other users of the pretix platform, resulting in a high confidentiality impact on both the vulnerable and subsequent systems. There is no integrity or availability impact — the vulnerability is purely a data exposure issue. In a multi-tenant or event-management context, exposed files could include personally identifiable information (PII), ticket data, or other sensitive documents uploaded by organizers or attendees (GitHub Advisory, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.038–0.063%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, ENISA EUVD).

1. Obtain a low-privilege account: Register or log in to a pretix instance with any valid user account.
2. Identify a target file UUID: Obtain the UUID of a file belonging to another user through indirect means — e.g., observing shared links, intercepting API responses, or brute-forcing UUID values (UUIDs may be predictable or leaked in certain contexts).
3. Craft a malicious API request: Send an authenticated HTTP request to one of the vulnerable API endpoints, supplying the target file's UUID as a parameter (e.g., GET /api/v1/files/<target-uuid>).
4. Retrieve the file: The server returns the file contents without verifying that the requesting user is the file's owner, exposing sensitive data (GitHub Advisory).

• Network: Unusual or repeated API requests to file-access endpoints with UUIDs not associated with the authenticated user's own uploads; high volume of file UUID lookups from a single account.
• Logs: Application access logs showing a single user account accessing file UUIDs belonging to multiple different users; HTTP 200 responses to file retrieval requests for files not uploaded by the requesting user.
• Behavioral: A user account making sequential or enumerated UUID-based file access requests in a short time window, suggesting automated scanning or enumeration.

Pretix released patched versions on December 18–19, 2025: 2025.8.3, 2025.9.3, and 2025.10.1. All users running versions prior to these releases should upgrade immediately. No configuration-based workaround is documented; upgrading to a patched version is the only recommended remediation. Additionally, administrators should audit API access logs for anomalous cross-user file access patterns (GitHub Advisory, pretix Blog).

The vulnerability received routine coverage from vulnerability tracking services including Vulners, CVEFeed, and CIRCL's Vulnerability Lookup shortly after disclosure. A brief post appeared on Bluesky via the CVE tracking account. No notable researcher commentary or significant media coverage has been identified beyond standard vulnerability database aggregation (CIRCL Mastodon).