CVE-2025-14882

Insecure direct object reference PUBLISHED

Description (CNA)

An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Affected (CNA)

Vendor / product	Versions
pretix / pretix-offlinesales	affected 1.12.0 through 1.12.1

CWE

CWE-639

References

https://pretix.eu/about/en/blog/20251218-release-2025-10-1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.