API Misconfiguration in Pretix Allows Unauthorized File Access

CVE-2026-9712

What is CVE-2026-9712?

A misconfiguration in the Pretix API allows API clients to use UUIDs to download files without proper verification of ownership. Typically, UUIDs generated for export jobs and temporary files are securely managed; however, one API endpoint fails to check if the UUID belongs to the correct user. While exploiting this issue may be difficult, as it requires prior access to valid UUIDs, the vulnerability poses a risk of unauthorized file access if such UUIDs are obtained. Users are advised to remain vigilant and monitor their access controls.

References