EUVD-2026-56017
GHSA-pm9m-4jvw-f3q5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network endpoint requires authenticated organizer (PR:L); ID enumeration adds negligible complexity (AC:L); integrity impact is high as arbitrary attendee data is written to victim events; no availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.
AnalysisAI
Insecure direct object reference in Attendize's bulk attendee import endpoint allows authenticated event organizers to inject attendee records into events owned by arbitrary third-party accounts. The postImportAttendee endpoint resolves target events by ID alone, without validating that the requesting organizer has ownership of the referenced event. All Attendize deployments through commit 9289acb are affected; no public exploit code or CISA KEV listing exists at time of analysis, but exploitation requires only a valid organizer account.
Technical ContextAI
Attendize is an open-source, self-hosted event management and ticketing platform (CPE: cpe:2.3:a:attendize:attendize:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-639 (Authorization Through User-Controlled Key): the postImportAttendee controller action accepts an event identifier supplied by the client and fetches the corresponding event record without cross-checking that the authenticated session belongs to the account that owns the event. This is a classic IDOR pattern where sequential or guessable resource IDs allow horizontal privilege escalation across account boundaries. The bulk-import feature compounds the impact by enabling mass injection of fabricated attendee data in a single request rather than one record at a time.
RemediationAI
The primary fix requires adding an ownership check in the postImportAttendee controller to verify that the authenticated organizer's account owns the event ID submitted in the request - for example, by scoping the event lookup to the current session's organizer ID (e.g., Event::where('id', $id)->where('organiser_id', auth()->user()->organiser->id)->firstOrFail()). Administrators should review the repository at https://github.com/Attendize/Attendize for commits after 9289acb that address this control. No vendor-released patched version has been independently confirmed; if no upstream fix is yet available, consider restricting the postImportAttendee endpoint to only accept event IDs that belong to the requesting organizer at the application firewall or middleware layer. As a compensating control, platform administrators can temporarily disable the bulk-import feature for untrusted organizer accounts or restrict organizer registration to vetted users, reducing the attacker pool while a patch is awaited. Monitor import activity logs for cross-account event ID usage as a detection signal.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persi
Insecure direct object reference in Attendize through commit 9289acb enables any authenticated event organiser to inject
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today