Listen to this Post
How the CVE Works
The vulnerability exists in an API endpoint designed to serve user-uploaded files, which are referenced by a unique UUID. The endpoint lacked proper authorization checks, trusting the UUID alone as sufficient for access control. By design, knowing a file’s UUID should only grant access if the requesting user has explicit permissions. However, the flawed logic permitted any authenticated user who obtained or guessed a target file’s UUID to retrieve it via a direct API call. This bypassed the intended business logic that validates the user’s association with the event, order, or context to which the file was uploaded. The system failed to verify if the requester owned the file or was authorized within its specific scope, leading to a direct object reference (IDOR) vulnerability. Attackers could exploit this by enumerating or discovering UUIDs from other parts of the application (e.g., in URLs or exports) to access sensitive files belonging to other users.
DailyCVE Form
Platform: pretix
Version: >=2025.10.0 <2025.10.1
Vulnerability: Broken Access Control
Severity: Low
Date: 2024-12-19
Prediction: Patched 2024-12-20
What Undercode Say:
curl -H "Authorization: Bearer <TOKEN>" https://target/api/v1/uploaded-files/<UUID>/ Attempts to fetch file via direct UUID reference.
grep -r "uploaded-files" ./pretix/src/api/ Locates vulnerable endpoint code.
How Exploit:
- Obtain a valid file UUID from another user’s context (e.g., via leaked export, guessable patterns).
- As an authenticated user, send a GET request to the vulnerable endpoint with the stolen UUID.
- The server returns the file content without checking authorization, achieving cross-user data access.
Protection from this CVE
Apply patched versions.
Implement object-level authorization.
Validate user-file ownership.
Impact:
Unauthorized file disclosure.
Cross-user data leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
