Read the docs
TI-2026-08511 Aliases CVE-2026-9712GHSA-72p9-6vv6-gvqh

Insecure direct object reference

Priority LOW 17CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download. One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00219 12th percentileScored 2026-11-07
Fix Fixed pretix (pretix): 2026.5.0pretix (PyPI): 2026.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pretixpretix2024.10.0 to before 2026.2.0; 2026.2.0 to before 2026.3.0; 2026.3.0 to before 2026.4.0; 2026.4.0 to before 2026.5.02026.5.0Patch availableCNA
—pretix (PyPI)before 2026.4.22026.4.2Patch availableGHSA-72p9-6vv6-gvqh
  • pretix Vendorpretix Affected 2024.10.0 to before 2026.2.0; 2026.2.0 to before 2026.3.0; 2026.3.0 to before 2026.4.0; 2026.4.0 to before 2026.5.0 Fixed in 2026.5.0 Patch available CNA
  • pretix (PyPI) Vendor— Affected before 2026.4.2 Fixed in 2026.4.2 Patch available GHSA-72p9-6vv6-gvqh

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:*——pretix
  • cpe:2.3:a:pretix:pretix:*:*:*:*:*:*:*:* Versions — — ·pretix

Remediation

  • Fix · CNA pretix (pretix) Fixed in 2026.5.0
  • Fix · GHSA-72p9-6vv6-gvqh pretix (PyPI) Fixed in 2026.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9712
  2. 2026-10-03 Alias added: GHSA-72p9-6vv6-gvqh

References

Advisory 2

Other 2

  • TI-2024-18268 pretix before 2024.1.1 mishandles file validation. CVSS 3.1CRITICAL 9.8
  • TI-2026-11524 SSRF with API key leak in pretix-oppwa CVSS 4.0CRITICAL 9.0
  • TI-2026-41416 Cross-site scripting in pretix CVSS 4.0HIGH 8.8
  • TI-2026-11523 Session takeover vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-02082 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
  • TI-2026-02081 Unsafe variable evaluation in email templates CVSS 4.0HIGH 7.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences