Attendize
Monthly
Insecure direct object reference in Attendize's bulk attendee import endpoint allows authenticated event organizers to inject attendee records into events owned by arbitrary third-party accounts. The postImportAttendee endpoint resolves target events by ID alone, without validating that the requesting organizer has ownership of the referenced event. All Attendize deployments through commit 9289acb are affected; no public exploit code or CISA KEV listing exists at time of analysis, but exploitation requires only a valid organizer account.
Insecure direct object reference in Attendize through commit 9289acb enables any authenticated event organiser to inject attendees and fraudulent orders into events belonging to other accounts via the postInviteAttendee endpoint. The root cause is a missing account-ownership check in the event lookup query - the endpoint resolves events by ID alone without verifying the requesting organiser's ownership. Exploitation allows an attacker to corrupt cross-account financial records and event data, with no public exploit identified and no CISA KEV listing at time of analysis.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persistent, mandatory survey questions into a different organizer's events by supplying an arbitrary event_id to the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method resolves the target event without applying tenant-isolation scoping, so the write succeeds across tenant boundaries; the injected question is then irremovable by the victim because the victim's account-scoped delete path cannot resolve a record owned by another tenant. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Insecure direct object reference in Attendize's bulk attendee import endpoint allows authenticated event organizers to inject attendee records into events owned by arbitrary third-party accounts. The postImportAttendee endpoint resolves target events by ID alone, without validating that the requesting organizer has ownership of the referenced event. All Attendize deployments through commit 9289acb are affected; no public exploit code or CISA KEV listing exists at time of analysis, but exploitation requires only a valid organizer account.
Insecure direct object reference in Attendize through commit 9289acb enables any authenticated event organiser to inject attendees and fraudulent orders into events belonging to other accounts via the postInviteAttendee endpoint. The root cause is a missing account-ownership check in the event lookup query - the endpoint resolves events by ID alone without verifying the requesting organiser's ownership. Exploitation allows an attacker to corrupt cross-account financial records and event data, with no public exploit identified and no CISA KEV listing at time of analysis.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persistent, mandatory survey questions into a different organizer's events by supplying an arbitrary event_id to the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method resolves the target event without applying tenant-isolation scoping, so the write succeeds across tenant boundaries; the injected question is then irremovable by the victim because the victim's account-scoped delete path cannot resolve a record owned by another tenant. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.