CVE-2026-9712: Insecure direct object reference
When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download.
One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Verify that the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the requesting user before returning the file.
pretix API (export/download endpoint) UUID download authorization check = enabled - Compensating control
Restrict and audit access to logs, temporary files and any storage that may contain or reveal export UUIDs to reduce the chance an attacker can obtain valid UUIDs through separate information exposure.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9712?
The severity of CVE-2026-9712 is considered low, with a CVSS base score of 3.8.
What type of vulnerability is CVE-2026-9712?
CVE-2026-9712 is classified as an insecure direct object reference vulnerability.
How do I fix CVE-2026-9712?
To fix CVE-2026-9712, ensure proper authentication and authorization checks are implemented for file access via the API.
What is the potential impact of CVE-2026-9712?
The potential impact of CVE-2026-9712 includes unauthorized access to file exports via the API.
Which software is affected by CVE-2026-9712?
CVE-2026-9712 affects the pretix software.