{"id":"CVE-2025-14881","title":"Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.","summary":"Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.","severity":"low","cwe":["CWE-639"],"vendor":"pretix","product":"pretix","affected":["pretix >= 2025.10.0, < 2025.10.1","pretix >= 2025.9.0, < 2025.9.3","pretix < 2025.8.3"],"patched":["pretix 2025.10.1","pretix 2025.9.3","pretix 2025.8.3"],"published":"2025-12-19","updated":"2026-10-14","sourceUpdated":"2026-10-14T16:10:00.250","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-14881","references":[{"url":"https://pretix.eu/about/en/blog/20251218-release-2025-10-1/","label":"655498c3-6ec5-4f0b-aea6-853b334d05a6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14881"},{"url":"https://github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479a"},{"url":"https://github.com/pretix/pretix"},{"url":"https://pretix.eu/about/en/blog/20251219-release-2025-10-1"}],"tags":["nvd","osv","pip"],"epss":0.00248,"epssPercentile":0.16021,"aliases":["GHSA-r2h2-g46h-8mx8","PYSEC-2026-1803"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:52.608Z","slug":"CVE-2025-14881","body":"## Overview\n\nMultiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-14881)\n\nAffected packages:\n\n- `pretix >= 2025.10.0, < 2025.10.1`\n- `pretix >= 2025.9.0, < 2025.9.3`\n- `pretix < 2025.8.3`\n\nPatched in:\n\n- `pretix 2025.10.1`\n- `pretix 2025.9.3`\n- `pretix 2025.8.3`\n\nSource: https://osv.dev/vulnerability/GHSA-r2h2-g46h-8mx8","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}