pretix EUVD-2026-88751

Exploitation requires a valid token-based API account on the pretix instance (PR:L) because the affected surface is the authenticated file-upload API. The attacker must additionally know or correctly reference the randomly generated UUID of a target file (AC:H / AT:P), and that file only exists for approximately one day before deletion, sharply limiting the window. The defect is that API-uploaded files are not correctly bound to the uploader's authentication method and a single session token is shared across all token-based API users, which defeats the intended isolation but does not by itself grant broad access. Limiting factors: requires API credentials, requires knowledge of an ephemeral random UUID, and the exposure window is ~24 hours.

This is a genuinely low-priority, low-real-risk issue and all signals agree. The vendor-assigned CVSS 4.0 base score is only 2.3, reflecting high attack complexity (AC:H), a special attack requirement (AT:P), and required privileges (PR:L) - an attacker must already hold a valid API token AND must reference a randomly generated UUID that only exists for about one day, per the vendor description. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so exploitation probability is effectively negligible. The flaw is a broken protection mechanism (API-uploaded files not correctly bound to the uploader's authentication method, plus a single shared session token across all token-based API users) rather than a directly exploitable data-exposure primitive; the vendor explicitly states 'there is virtually no risk.' No signals conflict: this is a defense-in-depth regression, not an actively dangerous vulnerability.

A legitimate API token holder on a pretix instance leverages the fact that all token-based API users share the same session token and that uploaded-file auth binding is broken to attempt access to another API user's uploaded file. To succeed they would have to know or guess the target file's randomly generated UUID within the roughly one-day window before it expires. No public exploit code exists.