CVE-2026-72690

Name of the Vulnerable Software and Affected Versions Attendize versions prior to commit 9289acb

Description An improper authorization issue allows an authenticated remote attacker to inject persistent mandatory survey questions into events managed by other organizers. This occurs because the postCreateEventQuestion() method loads the target event without applying tenant-isolation scope, which allows cross-tenant writes via the 'POST /event/{event id}/question/create' endpoint. Consequently, the victim cannot remove the injected questions because the account-scoped delete path cannot resolve questions owned by a different tenant.

Recommendations Update Attendize to a version that includes commit 9289acb or later.