CVE-2026-9712
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
27/05/2026
Last modified:
27/05/2026
Description
When creating an export through the pretix API, API clients are <br />
returned an UUID value for their export job (a long, random string like <br />
35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client <br />
can then request the actual file for download. The same kind of UUID is <br />
used in other places in pretix when temporary files are generated for <br />
internal use or download.<br />
<br />
<br />
<br />
<br />
One remaining API endpoint, however, wrongfully did not verify if the<br />
UUID used for download actually belongs to a file that is supposed to <br />
be downloadable and belongs to the correct user. In reality, this is <br />
hard to exploit because an attacker would need to have access to a valid<br />
UUID for the file they desire which is unlikely to happen without a <br />
separate security problem giving them access to logs etc.