EUVD-2026-55528
GHSA-6c35-rp78-p585
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-reachable endpoint, organizer-level authentication required (PR:L), no user interaction needed; no confidentiality loss, cross-tenant integrity fully compromised, minor persistent availability impact on victim.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
5DescriptionCVE.org
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.
AnalysisAI
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persistent, mandatory survey questions into a different organizer's events by supplying an arbitrary event_id to the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method resolves the target event without applying tenant-isolation scoping, so the write succeeds across tenant boundaries; the injected question is then irremovable by the victim because the victim's account-scoped delete path cannot resolve a record owned by another tenant. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Technical ContextAI
Attendize is an open-source, self-hosted event management and ticketing platform (CPE: cpe:2.3:a:attendize:attendize:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the application accepts an attacker-controlled event_id parameter and resolves the target event record without scoping the database query to the authenticated organizer's tenant. In correct multi-tenant design every data-access call at a tenancy boundary must include a predicate such as WHERE organizer_id = authenticated_user_tenant; the postCreateEventQuestion method omits this predicate entirely. The compounding irremovability arises because the victim's delete path does enforce tenant scoping, creating an asymmetry: the attacker can write cross-tenant but the victim cannot delete cross-tenant, leaving the injected question permanently resident on the event.
RemediationAI
The primary fix requires patching the postCreateEventQuestion method to scope the event lookup to the authenticated organizer's tenant before accepting question creation requests - for example, replacing an unscoped Event::find($event_id) with a tenant-filtered query such as auth()->user()->organiser->events()->findOrFail($event_id). The repository at https://github.com/Attendize/Attendize should be reviewed for commits beyond 9289acb that address this scoping gap; no confirmed patched release version was provided in the available intelligence, so administrators must verify the fix status directly against the repository. As a compensating control while a patch is evaluated, restrict organizer account provisioning exclusively to trusted parties and avoid operating Attendize in configurations where mutually untrusted organizers share an instance. If the survey and question feature is not in active use, disabling it at the application or routing layer eliminates the attack surface at the cost of removing that functionality entirely. A WAF rule blocking POST requests to /event/{id}/question/create from any session other than the event owner is architecturally difficult without application changes but can serve as a partial signal-detection measure.
Insecure direct object reference in Attendize's bulk attendee import endpoint allows authenticated event organizers to i
Insecure direct object reference in Attendize through commit 9289acb enables any authenticated event organiser to inject
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today