CVE-2026-122325

LOW 3.1

eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API

CVSS Score

3.1

EPSS Score

0.0%

EPSS Percentile

0th

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

CWE	CWE-639
Vendor	fossasia
Product	eventyay-exhibition
Published	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for fossasia eventyay-exhibition

Be the first to know when new low vulnerabilities affecting fossasia eventyay-exhibition are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

fossasia / eventyay-exhibition

f68888e312c220588ddc13f8bbc4bab927b5e530

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/fossasia/eventyay-exhibition/issues/343 github.com: https://github.com/fossasia/eventyay-exhibition/pull/383 github.com: https://github.com/fossasia/eventyay-exhibition/blob/f68888e312c220588ddc13f8bbc4bab927b5e530/exhibition/api.py#L399-L470 hackmd.io: https://hackmd.io/@hieuPenguinnn/eventyay-exhibition-cross-event-lead-idor github.com: https://github.com/fossasia/eventyay-exhibition vulncheck.com: https://www.vulncheck.com/advisories/eventyay-exhibition-through-commit-f68888e-cross-event-attendee-data-disclosure-via-lead-creation-api

Credits

hieuPenguinnn