EUVD-2026-56016
GHSA-rvg3-vfj6-mf9f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network-reachable web endpoint; PR:L because a valid organiser account is required; I:H for cross-account record injection; C:L for incidental read access to foreign event metadata; A:N as no service disruption results.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.
AnalysisAI
Insecure direct object reference in Attendize through commit 9289acb enables any authenticated event organiser to inject attendees and fraudulent orders into events belonging to other accounts via the postInviteAttendee endpoint. The root cause is a missing account-ownership check in the event lookup query - the endpoint resolves events by ID alone without verifying the requesting organiser's ownership. Exploitation allows an attacker to corrupt cross-account financial records and event data, with no public exploit identified and no CISA KEV listing at time of analysis.
Technical ContextAI
Attendize is an open-source, self-hosted event management and ticketing platform (CPE: cpe:2.3:a:attendize:attendize:*:*:*:*:*:*:*:*). The vulnerability is classified under CWE-639 (Authorization Through User-Controlled Key), a subclass of broken access control in which an application authenticates a user but then uses a user-supplied identifier to load a resource without verifying that the authenticated principal owns or is authorized to access that resource. Specifically, the postInviteAttendee controller endpoint accepts an event ID parameter from the caller and issues a database query using that ID directly, without appending an organiser-scoping condition (e.g., WHERE organiser_id = authenticated_user). Because event IDs are presumed to be sequential or otherwise enumerable integers, any organiser-level user can iterate through IDs to target events registered under other accounts.
RemediationAI
No vendor-released patch or tagged fix release has been independently confirmed at time of analysis - the sole reference available points to the Attendize GitHub repository (https://github.com/Attendize/Attendize), not a specific advisory or release. Operators should monitor the repository for commits that add organiser-scoped authorization checks to the postInviteAttendee endpoint (e.g., scoping event lookups with WHERE organiser_id = authenticated_user_id). As an immediate compensating control, restrict organiser account self-registration to trusted individuals only, reducing the set of principals capable of exploitation - note this does not eliminate risk from insider threats or compromised accounts. Deployers should also place the Attendize admin and organiser interface behind network-level access controls (VPN or IP allowlist) to reduce the attack surface from external actors. Auditing existing attendee and order records for anomalies - such as entries added by organisers who do not own the associated event - is advisable to detect any prior exploitation.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persi
Insecure direct object reference in Attendize's bulk attendee import endpoint allows authenticated event organizers to i
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today