CVE-2026-72547

Name of the Vulnerable Software and Affected Versions Attendize versions prior to commit 9289acb

Description An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can bulk import attendees into events belonging to other accounts through the 'postImportAttendee' endpoint. The system loads the target event by ID without verifying if the requesting organiser account owns the event, allowing an attacker to inject bulk attendee data into any event regardless of account boundaries.

Recommendations Update Attendize to a version including commit 9289acb or later. Restrict access to the 'postImportAttendee' endpoint to ensure ownership verification is performed before processing imports.