Low severity · published Dec 19, 2025
CVE-2025-14881
Insecure direct object reference
3.8
CVSS
0.2%
EPSS
No
On KEV
Description
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
pretix · pretix
1.0.0 before 2025.8.0; 2025.8.0 before 2025.9.0; 2025.9.0 before 2025.10.0; 2025.10.0 before 2025.11.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14881
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14881
pretix.eu
https://pretix.eu/about/en/blog/20251218-release-2025-10-1/
More from pretix
9.8
CVE-2024-27447
pretix before 2024.1.1 mishandles file validation
8.8
CVE-2026-57532
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser
7.7
CVE-2026-13602
Session takeover vulnerability
6.5
CVE-2026-2452
Unsafe variable evaluation in email templates
6.5
CVE-2026-2451
Unsafe variable evaluation in email templates