Insecure direct object reference
Priority LOW 18CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00248 16th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2025.11.0pretix (PyPI): 2025.10.1, 2025.9.3, 2025.8.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pretix | pretix | 1.0.0 to before 2025.8.0; 2025.8.0 to before 2025.9.0; 2025.9.0 to before 2025.10.0; 2025.10.0 to before 2025.11.0 | 2025.11.0 | Patch available | CNA |
| — | pretix (PyPI) | 2025.10.0 to before 2025.10.1 | 2025.10.1 | Patch available | GHSA-r2h2-g46h-8mx8 |
| — | pretix (PyPI) | 2025.9.0 to before 2025.9.3 | 2025.9.3 | Patch available | GHSA-r2h2-g46h-8mx8 |
| — | pretix (PyPI) | before 2025.8.3 | 2025.8.3 | Patch available | GHSA-r2h2-g46h-8mx8 |
- pretix Vendorpretix Affected 1.0.0 to before 2025.8.0; 2025.8.0 to before 2025.9.0; 2025.9.0 to before 2025.10.0; 2025.10.0 to before 2025.11.0 Fixed in 2025.11.0 Patch available CNA
- pretix (PyPI) Vendor— Affected 2025.10.0 to before 2025.10.1 Fixed in 2025.10.1 Patch available GHSA-r2h2-g46h-8mx8
- pretix (PyPI) Vendor— Affected 2025.9.0 to before 2025.9.3 Fixed in 2025.9.3 Patch available GHSA-r2h2-g46h-8mx8
- pretix (PyPI) Vendor— Affected before 2025.8.3 Fixed in 2025.8.3 Patch available GHSA-r2h2-g46h-8mx8
Remediation
- Fix · CNA pretix (pretix) Fixed in 2025.11.0
- Fix · GHSA-r2h2-g46h-8mx8 pretix (PyPI) Fixed in 2025.10.1 Advisory →
- Fix · GHSA-r2h2-g46h-8mx8 pretix (PyPI) Fixed in 2025.9.3 Advisory →
- Fix · GHSA-r2h2-g46h-8mx8 pretix (PyPI) Fixed in 2025.8.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14881
- 2026-10-03 Alias added: GHSA-r2h2-g46h-8mx8
References
More pretix vulnerabilities
- TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
- TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
- TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
- TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
- TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
- TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
Sources
- CVE-2025-14881 · CVE Program
- CVE-2025-14881 · NVD
- FIRST EPSS
- GHSA-r2h2-g46h-8mx8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences