CVE Feed

    Dashboard / CVE / CVE-2025-14882

    CVE-2025-14882

    An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

    Published:Dec 19, 2025
    Last Modified:Apr 15, 2026
    EPS:Dec 19, 2025
    EPSS Score:0.00058
    CVSS Score:3.8

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…
    CVE-2026-57532 (CVSS 8.8) — Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed whe…
    CVE-2026-57533 (CVSS 2.1) — Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occ…
    CVE-2026-57535 (CVSS 2.1) — Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. I…
    CVE-2026-13225 (CVSS 5.3) — Malicious HTML content could be injected into the email address of an order, which pretix showed without sani…
    CVE-2026-11764 (CVSS 3.6) — When creating an export of all reusable media, the secrets of connected gift cards were included in the expor…
    CVE-2026-9712 (CVSS 3.8) — When creating an export through the pretix API, API clients are returned an UUID value for their export job (…
    CVE-2026-5600 (CVSS 5.5) — A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific eve…
    CVE-2026-2452 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High