CVE-2026-9712
BaseFortify
Publication date: 2026-05-27
Last updated on: 2026-05-27
Assigner: rami.io
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the pretix API when creating an export job. The API returns a UUID to the client, which is used to request the export file for download. However, one API endpoint does not properly verify whether the UUID used for downloading a file actually belongs to a file that should be downloadable or to the correct user.
This means that if an attacker obtains a valid UUID for a file, they might be able to download files they are not authorized to access. However, exploiting this vulnerability is difficult because obtaining a valid UUID without another security issue (such as access to logs) is unlikely.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker who manages to obtain a valid UUID could potentially download files they should not have access to. This could lead to unauthorized disclosure of sensitive information.
However, the vulnerability is rated with a relatively low severity (CVSS 3.8), and exploitation is considered hard because it requires access to a valid UUID, which is unlikely without another security flaw.