CVE-2026-9712: Pretix Authentication Bypass Vulnerability

CVE-2026-9712 Overview

CVE-2026-9712 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the pretix ticketing platform API. The flaw resides in a download endpoint that fails to verify whether the UUID supplied for a file download belongs to the requesting user. An authenticated API client holding a valid UUID can retrieve files that should not be accessible to them. Pretix addressed the issue in release 2026.4.2.

Critical Impact
An authenticated attacker who obtains a valid export job UUID can download files belonging to other users through the affected pretix API endpoint.

Affected Products

pretix (self-hosted and hosted) versions prior to 2026.4.2
pretix API export download endpoint
Temporary file download UUIDs used by internal pretix components

Discovery Timeline

2026-05-27 - CVE-2026-9712 published to NVD
2026-05-27 - pretix release 2026.4.2 published with fix
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9712

Vulnerability Analysis

The pretix API issues UUID values (for example 35742818-c375-4d15-839f-d49aecce94d6) when an API client requests an export. The client then uses the UUID to retrieve the generated file. The same UUID scheme is reused across pretix for temporary files produced for internal operations and user downloads.

One API endpoint did not enforce an authorization check tying the UUID to the requesting user. As a result, any authenticated API client presenting a valid UUID could fetch the associated file. The vulnerability falls under Authorization Bypass via Insecure Direct Object Reference.

The scope of impact is limited to confidentiality of files generated through the affected workflow. The vulnerability does not directly enable code execution, modification, or denial of service.

Root Cause

The root cause is missing object-level authorization on the affected download endpoint. The handler validated that the UUID corresponded to a known file but failed to verify ownership or download eligibility. This matches the [CWE-639] pattern of authorization based solely on a guessable or leakable identifier rather than on the requester's identity.

Attack Vector

Exploitation requires the attacker to be an authenticated, low-privileged API client and to already possess a valid UUID corresponding to the target file. UUIDs are 128-bit random values, so guessing is not practical. The vendor notes that practical exploitation typically depends on a secondary issue such as log exposure or interception that reveals UUIDs to an attacker.

The vulnerability mechanism is described in prose only. Refer to the Pretix Blog Release Notes for vendor-provided technical context.

Detection Methods for CVE-2026-9712

Indicators of Compromise

API access logs showing a single authenticated user requesting download UUIDs that were issued to a different user or organizer account.
Requests to the affected file download endpoint that succeed for UUIDs never issued in that user's session history.
Unusual volume of download requests targeting sequential or harvested UUIDs from a single API token.

Detection Strategies

Correlate pretix API export creation events with subsequent download events and alert when the downloading principal differs from the creator.
Review web server and application logs for download endpoint access patterns that do not match the expected per-user UUID issuance.
Monitor for credential or log exposure incidents that could leak export UUIDs to unauthorized parties.

Monitoring Recommendations

Forward pretix application logs and reverse-proxy access logs to a centralized log platform for cross-user UUID correlation.
Enable verbose logging on the export and download endpoints during upgrade validation to confirm the patch is enforced.
Track API token usage baselines and alert on deviations such as new download endpoints being accessed by tokens that previously did not use them.

How to Mitigate CVE-2026-9712

Immediate Actions Required

Upgrade pretix to version 2026.4.2 or later on all self-hosted instances.
Rotate API tokens for accounts that may have had export UUIDs exposed in logs, tickets, or chat systems.
Review historical access logs for the affected download endpoint to identify any cross-account UUID usage.

Patch Information

Pretix released version 2026.4.2 on 2026-05-27, which adds the missing ownership check to the affected download endpoint. Details are documented in the Pretix Blog Release Notes. Hosted pretix customers receive the fix automatically; self-hosted operators must update their deployments.

Workarounds

Restrict network access to the pretix API to trusted clients until the upgrade is applied.
Limit log retention and access for any system that may capture export UUIDs in URLs or request bodies.
Avoid sharing export UUIDs through channels (email, ticketing, chat) that broaden their exposure window.

bash

# Upgrade pretix self-hosted deployment to the patched release
pip install --upgrade "pretix==2026.4.2"
python -m pretix migrate
systemctl restart pretix-web pretix-worker