Events-Management-System EUVD-2026-104328

Exploitation requires only network reachability to an Internet- or LAN-exposed instance of satya-vinay Events-Management-System; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed, and multiple endpoints are affected. The primary LIMITING factors are not technical prerequisites but deployment reality: the product is an obscure rolling-release GitHub project with no version pinning, so defenders must identify instances by commit/deployment rather than version, and the flaw yields only Low-impact unauthorized access (VC:L/VI:L/VA:L, no scope change) rather than full compromise. The specific vulnerable functionality is not enumerated in the source data, which limits precise detection and mitigation guidance.

Signals conflict on real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely exploitable, unauthenticated, low-complexity missing-authentication flaw (CWE-306), which superficially sounds serious, but every impact metric is only Low (VC:L/VI:L/VA:L, no scope change), capping the score at 6.9 (Medium). The embedded Exploitation sub-metric E:P (Proof-of-Concept) is corroborated by the input flag that public exploit code exists - publicly available exploit code exists, but this is NOT the same as active exploitation. This CVE is NOT on CISA KEV and no EPSS score was provided, so there is no evidence of widespread automated exploitation. The affected software, satya-vinay Events-Management-System, is an obscure individual GitHub project with no identifiable enterprise footprint, and the vendor was notified via an issue report but has not responded, meaning no official patch exists. Net assessment: this is a genuine unauthenticated auth-bypass with public PoC, but the low technical impact and near-zero deployment footprint make it a low real-world priority despite the Medium CVSS - a classic case of a legitimate flaw in software almost no production environment runs.

A remote, unauthenticated attacker identifies an Internet-exposed instance of the Events-Management-System and sends requests directly to one of the multiple affected endpoints that fail to enforce authentication, gaining access to functionality that should require a valid session. Public exploit/PoC detail is available via the project's GitHub issue tracker, lowering the skill barrier. Because impact is rated Low across confidentiality, integrity and availability, the attacker obtains limited unauthorized access rather than full system compromise.