CVE-2026-72546

HIGH 7.1

Attendize Attendize - Insecure Direct Object Reference

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.

CWE	CWE-639
Vendor	attendize
Product	attendize
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for attendize attendize

Be the first to know when new high vulnerabilities affecting attendize attendize are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Attendize / Attendize

0 ≤ 9289acb

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Attendize/Attendize

Credits

Bobur Abdugafforov (Mahadsec)