Which versions of Open Event Server are affected by CVE-2026-63101?

FOSSASIA Open Event Server versions through 1.19.1 contain an unauthenticated information disclosure vulnerability allowing remote attackers to export complete member rosters including email…

Is there a public PoC exploit available for CVE-2026-63101?

Yes, a public proof-of-concept exploit is available for CVE-2026-63101. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-63101?

Within 24 hours: immediately disable or restrict access to the group followers CSV export endpoint at the firewall or application layer, and require authentication on all export functions. Within 7 days: deploy Web Application Firewall (WAF) rules to block unauthenticated export requests, implement rate limiting on export functionality, and enable detailed audit logging to detect suspicious export activity patterns. Within 30 days: monitor FOSSASIA Open Event Server repositories for release of patched versions (1.19.2 or later), schedule patching upon release, and evaluate alternative event management platforms if patch timelines are not provided by FOSSASIA.

Open Event Server CVE-2026-63101

Q: What is the CVSS score of CVE-2026-63101?

CVE-2026-63101 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45202 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-17 VulnCheck

GHSA-ggm5-8rm7-3jgc

Authentication Bypass Open Event Server

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity request to an endpoint missing auth (AV:N/AC:L/PR:N/UI:N) that discloses PII only, so C:H with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:45 vuln.today

CVE Published

Jul 17, 2026 - 15:51 cve.org

HIGH 8.7

DescriptionCVE.org

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, trigger an export via the unauthenticated POST endpoint, then poll the unauthenticated task status endpoint until completion to retrieve a download URL containing the full member CSV.

AnalysisAI

Sensitive information disclosure in FOSSASIA Open Event Server through 1.19.1 lets unauthenticated remote attackers export the full member roster of any group - email addresses, names, join dates, and roles - because the group followers CSV export endpoint carries no authentication decorator. Publicly available exploit code exists; the flaw is trivially automatable by enumerating sequential group IDs, triggering an export, and polling the unauthenticated task-status endpoint for the download URL. No public exploit has been added to CISA KEV, but the CVSS 4.0 base score of 8.7 (High) and confirmed PoC make it a credible mass-scraping risk.

Technical ContextAI

Open Event Server is FOSSASIA's open-source, Flask/Python REST API backend for event management (the server component behind the Open Event/Eventyay platform), which supports group 'followers' and CSV exports of member data. The root cause is CWE-306 (Missing Authentication for a Critical Function): the group followers CSV export POST endpoint, the associated task-status polling endpoint, and the resulting download URL all lack the authentication decorator applied elsewhere in the API, so authorization is never enforced for an operation that returns personally identifiable member data. The affected package is identified by cpe:2.3:a:fossasia:open-event-server:*:*:*:*:*:*:*:* for all versions up to and including 1.19.1.

RemediationAI

No vendor-released patch version is identified in the available data (only advisory and PoC references are provided), so treat the fix version as unconfirmed and verify directly against the FOSSASIA open-event-server repository for a release above 1.19.1 that adds authentication to the followers export path. As concrete compensating controls until a patched release is confirmed: restrict or block network access to the group followers CSV export POST endpoint, its task-status endpoint, and the export download URL at a reverse proxy or WAF (trade-off: legitimate export users must be routed through an authenticated path); place the server behind an authentication gateway/VPN so anonymous requests cannot reach the API (trade-off: breaks any intended public API consumers); and disable or feature-flag the follower CSV export functionality if it is not required (trade-off: loss of export capability for organizers). Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/open-event-server-unauthenticated-member-roster-export-via-csv-export-endpoint) for authoritative details and monitor it for the tagged fix version.