CVE-2026-72547 in Attendize
Summary
by MITRE • 08/11/2026
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical insecure direct object reference flaw that undermines the authentication and authorization mechanisms within the Attendize web application. The issue manifests specifically within the postImportAttendee endpoint where the system fails to validate whether the authenticated user has legitimate ownership rights over the target event they are attempting to modify. This weakness allows any authenticated user to manipulate event identifiers in bulk import operations, effectively bypassing the intended access controls that should prevent cross-account data manipulation. The vulnerability stems from a fundamental failure in implementing proper object-level access control checks before executing sensitive operations on system resources.
The technical implementation of this flaw enables attackers to leverage their legitimate login credentials to perform unauthorized actions against resources they do not own. When an authenticated event organizer makes a request to the postImportAttendee endpoint, the application retrieves the target event solely based on the provided event ID parameter without cross-referencing it against the requesting user's account ownership permissions. This creates a scenario where attackers can systematically iterate through event identifiers and inject bulk attendee data into any event within the system's database regardless of which account originally created that event. The vulnerability essentially transforms what should be a controlled, permission-based operation into an unrestricted data modification capability.
The operational impact of this vulnerability extends beyond simple data integrity concerns to encompass significant security implications for event organizers and their attendees. Attackers can potentially disrupt event operations by injecting malicious attendee information, manipulate attendance records, or even access sensitive data belonging to other users' events. The bulk import functionality amplifies the damage potential as a single compromised account can be used to modify multiple events simultaneously. This vulnerability directly violates the principle of least privilege and demonstrates a critical failure in the application's authorization model, potentially leading to data breaches, service disruption, and reputational damage for the platform and its users.
From a cybersecurity perspective, this vulnerability aligns with CWE-285, which addresses improper authorization issues, and maps to ATT&CK technique T1078.004 for valid accounts and T1566.001 for credential access through social engineering or account compromise. The flaw enables attackers to escalate their privileges beyond what was originally intended, effectively allowing them to assume control over events belonging to other users. Organizations should implement proper input validation and access control checks at the application level, ensuring that all object references are validated against user permissions before executing any modification operations. Additionally, organizations should consider implementing rate limiting and monitoring for unusual bulk import activities that could indicate exploitation attempts, along with comprehensive logging of all event modification activities to detect unauthorized access patterns.