The Pretix export API issues a unique identifier for each export job, and that identifier is subsequently used to request the file for download. One API endpoint fails to confirm that the UUID supplied for a download actually belongs to a file that the requesting user is permitted to retrieve. This is an instance of a direct object reference flaw (CWE‑639) that could allow a malicious actor to download files they should not have access to if they possess a valid UUID. However, because obtaining a valid UUID would normally require access to logs or prior exploitation, the actual likelihood of successful exploitation is low, as reflected in the CVSS score of 3.8.

The vulnerability affects the Pretix event‑ticketing system (vendor pretix). Versions prior to the 2026‑4‑2 release are potentially vulnerable, as that release applies the missing verification logic for UUIDs. The specific affected versions are not listed explicitly, but the problem is known to exist in releases before the 2026‑4‑2 update.

With a CVSS score of 3.8, the severity is low. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been exploited in the wild. The attack vector requires the attacker to obtain a valid UUID that is not owned by the target user, which is difficult without an additional security issue that exposes such identifiers. Consequently, the overall risk to an organization running an older Pretix installation is moderate, with low probability of exploitation but potential for minor unauthorized file disclosure.