CVE-2025-14882: 
Python vulnerability analysis and mitigation

CVE-2025-14882 is a Broken Access Control vulnerability in the pretix ticketing software that allows authenticated low-privilege users to access sensitive files belonging to other users by knowing or guessing the UUID of those files. The flaw affects pretix versions < 2025.8.3, >= 2025.9.0 and < 2025.9.3, and >= 2025.10.0 and < 2025.10.1. It was published on December 19, 2025, with a patch released the same day. The vulnerability carries a CVSS v4.0 base score of 3.8 (Low) (GitHub Advisory).

The root cause is an Insecure Direct Object Reference (IDOR) flaw classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A specific API endpoint in pretix failed to enforce proper authorization checks, relying solely on a file's UUID as an access control mechanism rather than verifying that the requesting user is the legitimate owner of the file. An attacker with a valid low-privilege account can craft API requests to that endpoint supplying UUIDs of files belonging to other users, bypassing intended access restrictions. The fix is visible in commit 4b56518 of the pretix repository (GitHub Advisory, Pretix Blog).

Successful exploitation results in unauthorized disclosure of sensitive files stored within the pretix platform, with a high confidentiality impact on both the vulnerable system and subsequent systems. An attacker can retrieve files across different user accounts without authorization, potentially exposing ticket data, personal information, or other confidential documents managed by the platform. There is no integrity or availability impact — the vulnerability is limited to unauthorized read access (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038–0.063%, placing it in the lower percentiles for exploitation likelihood. Exploitation requires a valid low-privilege account on the target pretix instance, and the attack complexity is low once a valid UUID is known or enumerated.

1. Obtain a low-privilege account: Register or obtain credentials for any valid user account on the target pretix instance.
2. Identify the vulnerable API endpoint: Locate the API endpoint responsible for file retrieval, which accepts a UUID parameter to identify files.
3. Enumerate or guess UUIDs: UUIDs may be obtained through prior interaction with the platform (e.g., observing UUIDs from one's own files), brute-force enumeration, or by intercepting API responses. UUID v4 values are random but may be leaked through other application features.
4. Craft unauthorized API request: Send an authenticated HTTP request to the vulnerable endpoint supplying a UUID belonging to another user's file (e.g., GET /api/v1/files/<other-user-uuid> with a valid session token).
5. Retrieve sensitive file: The server returns the file contents without verifying ownership, granting access to the other user's sensitive data (GitHub Advisory).

• Network: Unusual API requests to file retrieval endpoints from authenticated users accessing UUIDs not associated with their own account; high volume of sequential or random UUID-based file access requests from a single user.
• Logs: Application access logs showing a single authenticated user account requesting files with UUIDs belonging to multiple different users; repeated 200 OK responses to file API requests from accounts with no prior association to those files.
• Behavioral: A single low-privilege user account generating an abnormally high number of file access API calls in a short time window, consistent with UUID enumeration.

Pretix has released patched versions addressing this vulnerability: 2025.8.3, 2025.9.3, and 2025.10.1. All users running affected versions (< 2025.8.3, >= 2025.9.0 and < 2025.9.3, or >= 2025.10.0 and < 2025.10.1) should upgrade immediately. No configuration-based workaround is documented; upgrading to a patched release is the only recommended remediation (GitHub Advisory, Pretix Blog).

The pretix development team disclosed the vulnerability via their official blog alongside the release of the patched versions on December 19, 2025 (Pretix Blog). No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database aggregation.