3.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9712

CVE-2026-9712: pretix vulnerable to Authorization Bypass Through User-Controlled Key

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download.

One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9712

CVE-2026-9712:

3.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pretix	pip	< 2026.4.2	2026.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an authorization bypass when downloading files. The advisory mentions that a specific API endpoint did not properly verify user permissions. To pinpoint the vulnerable function, I analyzed the changes between the last vulnerable version (2026.4.1) and the first patched version (2026.4.2) of pretix/pretix.

The commit 866a5cde4221490be145facf5f167fdae2fe154c, titled "[SECURITY] Add missing session check for cached files (CVE-2026-9712)", contains the security fix.

This commit modifies the file src/pretix/plugins/ticketoutputpdf/api.py. Specifically, it adds a session check to the download method within a ViewSet class (inferred to be TicketOutputPDFViewSet based on convention). Before the patch, this function would fetch and serve a CachedFile based on its ID from the URL, without checking if the requesting user had the right to access it. The patch introduces a call to cf.allowed_for_session() to perform this crucial authorization check.

The render_batch function was also updated to associate the file with the user's session, enabling the new check in download to work correctly. The core of the vulnerability, however, lies in the download function where the access control was missing.

Vulnerable functions

TicketOutputPDFViewSet.download

src/pretix/plugins/ticketoutputpdf/api.py

The `download` function was vulnerable to an insecure direct object reference (IDOR). It allowed an authenticated user to download a cached file by its ID without verifying if the user was authorized to access that file. An attacker who obtained a file's ID could download it, bypassing authorization.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.