VulnerabilityDeferred

CVE-2025-14881

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

LOW 3.8EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

CVSS 4.0: 3.8 LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: 655498c3-6ec5-4f0b-aea6-853b334d05a6

References

https://pretix.eu/about/en/blog/20251218-release-2025-10-1/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.