CVE-2025-14881Low▾ SunlitMultiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 13.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
0.2% → 0.2%
Last analysed / modified upstream
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
pretix >= 2025.10.0, < 2025.10.1pretix >= 2025.9.0, < 2025.9.3pretix < 2025.8.3Patched in:
pretix 2025.10.1pretix 2025.9.3pretix 2025.8.3Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14882Lowpretix has Broken Access Control Allowing Cross-User File Access via UUID
CVE-2023-44464High· 7.8pretix allows Pillow to parse EPS files
CVE-2026-9712Lowpretix vulnerable to Authorization Bypass Through User-Controlled Key
CVE-2026-101273Medium· 5.3Giftcard enumeration
CVE-2026-101274Medium· 6.9When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the S…
CVE-2026-101272Low· 2.3Incorrect session validation for API-created shredder exports