CVE-2026-72546

Name of the Vulnerable Software and Affected Versions Attendize versions prior to commit 9289acb

Description An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can inject attendees and orders into events belonging to other accounts through the 'postInviteAttendee' endpoint. The issue arises because the endpoint loads the target event by ID without scoping the query to the authenticated organiser account, allowing an attacker to modify event data and financial records across account boundaries.

Recommendations Update Attendize to a version including commit 9289acb or later. Restrict access to the 'postInviteAttendee' endpoint to ensure users can only modify events associated with their own account.