CVE-2026-63101

Name of the Vulnerable Software and Affected Versions Open Event Server versions prior to 1.19.2

Description A missing authentication flaw allows unauthenticated attackers to export the complete member roster of any group, including names, email addresses, roles, and join dates. This is possible because the group followers CSV export endpoint lacks an authentication decorator. An attacker can use brute-force to enumerate sequential group IDs, trigger an export via an unauthenticated POST endpoint, and poll an unauthenticated task status endpoint to obtain a download URL for the member CSV.

Recommendations Update to version 1.19.2 or later.