CVE-2026-72547

HIGH 7.1

Attendize Attendize - Insecure Direct Object Reference

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.

CWE	CWE-639
Vendor	attendize
Product	attendize
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for attendize attendize

Be the first to know when new high vulnerabilities affecting attendize attendize are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Attendize / Attendize

0 ≤ 9289acb

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Attendize/Attendize

Credits

Bobur Abdugafforov (Mahadsec)