CVE-2026-72690

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Attendize/Attendize

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de autorización indebida en Attendize a través del commit 9289acb permite a un atacante remoto autenticado inyectar preguntas de encuesta obligatorias persistentes en los eventos de otro organizador a través del endpoint POST /event/{event_id}/question/create. El método postCreateEventQuestion carga el evento objetivo sin el alcance de aislamiento de inquilinos, lo que permite escrituras entre inquilinos; la pregunta inyectada no puede ser eliminada por la víctima porque la ruta de eliminación con alcance de cuenta de la víctima no puede resolver una pregunta propiedad de otro inquilino.

Information

Published : 2026-08-10 13:20

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72690

Mitre link : CVE-2026-72690

CVE.ORG link : CVE-2026-72690

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-72690", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72690", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T15:47:06.344487Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "Attendize", "product": "Attendize", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "9289acb"}], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:39.230", "references": [{"url": "https://github.com/Attendize/Attendize", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant."}, {"lang": "es", "value": "Una vulnerabilidad de autorizaci\u00f3n indebida en Attendize a trav\u00e9s del commit 9289acb permite a un atacante remoto autenticado inyectar preguntas de encuesta obligatorias persistentes en los eventos de otro organizador a trav\u00e9s del endpoint POST /event/{event_id}/question/create. El m\u00e9todo postCreateEventQuestion carga el evento objetivo sin el alcance de aislamiento de inquilinos, lo que permite escrituras entre inquilinos; la pregunta inyectada no puede ser eliminada por la v\u00edctima porque la ruta de eliminaci\u00f3n con alcance de cuenta de la v\u00edctima no puede resolver una pregunta propiedad de otro inquilino."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}