Low severityGHSA Advisory· Published Dec 19, 2025· Updated Apr 15, 2026

CVE-2025-14881

Description

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pretixPyPI	>= 2025.10.0, < 2025.10.1	2025.10.1
pretixPyPI	>= 2025.9.0, < 2025.9.3	2025.9.3
pretixPyPI	< 2025.8.3	2025.8.3

Affected products

Pretix/PretixGHSA
Range: < 2025.8.3
ghsa-coords
pkg:pypi/pretix
Range: >= 2025.10.0, < 2025.10.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-r2h2-g46h-8mx8ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-14881ghsaADVISORY
github.com/pretix/pretix/commit/4b5651862c57c6e384822d1d23292342126c479aghsaWEB
pretix.eu/about/en/blog/20251219-release-2025-10-1ghsaWEB
pretix.eu/about/en/blog/20251218-release-2025-10-1/nvd

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000