CVE-2026-72547

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Attendize/Attendize

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de referencia directa insegura a objetos en Attendize hasta el commit 9289acb permite a cualquier organizador de eventos autenticado importar asistentes de forma masiva en eventos pertenecientes a otras cuentas a través del endpoint postImportAttendee. El endpoint carga el evento objetivo por ID sin verificar la propiedad frente a la cuenta del organizador solicitante. Un atacante puede inyectar datos de asistentes de forma masiva en cualquier evento del sistema, independientemente de los límites de la cuenta.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72547

Mitre link : CVE-2026-72547

CVE.ORG link : CVE-2026-72547

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-72547", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72547", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T15:09:51.671249Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Attendize", "product": "Attendize", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "9289acb"}]}]}], "published": "2026-08-11T12:17:40.233", "references": [{"url": "https://github.com/Attendize/Attendize", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries."}, {"lang": "es", "value": "Una vulnerabilidad de referencia directa insegura a objetos en Attendize hasta el commit 9289acb permite a cualquier organizador de eventos autenticado importar asistentes de forma masiva en eventos pertenecientes a otras cuentas a trav\u00e9s del endpoint postImportAttendee. El endpoint carga el evento objetivo por ID sin verificar la propiedad frente a la cuenta del organizador solicitante. Un atacante puede inyectar datos de asistentes de forma masiva en cualquier evento del sistema, independientemente de los l\u00edmites de la cuenta."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}