A mechanism designed to bind API‑uploaded files to the uploader’s session token does not function correctly, causing all token‑based API users to share the same session token. Because uploaded files are referenced by random UUIDs and automatically deleted after one day, the direct security risk is low; however, the intended protection mechanism is rendered ineffective.

The vulnerability affects the pretix event‑ticketing platform. Versions prior to the 2026‑7‑01 release are impacted; no specific version range is listed in the available data.

The CVSS score is 2.3, indicating a low severity issue. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector involves internal or external API access using legitimate API tokens, but the short lifespan of files and the absence of additional identified privileges mean that exploitation is unlikely to pose significant danger.