CVE-2026-72690 in Attendize
Summary
by MITRE • 08/10/2026
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization flaw in the Attendize event management platform that enables cross-tenant data manipulation through improper access control implementation. The issue stems from the absence of proper tenant isolation mechanisms within the postCreateEventQuestion method, which processes requests to create survey questions for events. When an authenticated attacker submits a request to the POST /event/{event_id}/question/create endpoint, the system fails to validate whether the requesting user has legitimate authorization to modify the target event, particularly when that event belongs to a different tenant organization. This fundamental breakdown in access control allows malicious actors to inject persistent mandatory survey questions into events they do not own or control.
The technical implementation of this vulnerability demonstrates a classic case of insufficient authorization checks combined with inadequate scope validation. The system loads the target event without applying the necessary tenant-isolation scope, meaning that users can potentially modify events belonging to other organizations simply by knowing valid event identifiers. This flaw directly violates the principle of least privilege and creates a persistent security risk where attacker-controlled content can be injected into legitimate business processes. The vulnerability is particularly dangerous because it enables the creation of mandatory survey questions that become part of the event's core functionality, affecting all participants who engage with those events.
The operational impact of this vulnerability extends beyond simple data injection, creating significant risks for both the compromised organizations and end users. When an attacker successfully injects mandatory survey questions into another organizer's event, they gain the ability to collect potentially sensitive information from event participants without their knowledge or consent. The persistent nature of these injected questions means that the malicious content remains active until manually removed by someone with appropriate administrative privileges, which may not be possible for the legitimate event owner due to the cross-tenant access control restrictions. This creates a situation where event organizers cannot remediate the issue through normal deletion procedures, leading to ongoing security exposure and potential data privacy violations.
The exploitation of this vulnerability aligns with attack patterns identified in the MITRE ATT&CK framework under the privilege escalation and persistence categories, specifically demonstrating how insufficient authorization controls can enable attackers to maintain access to systems beyond their initial compromise. This flaw represents a CWE-285 (Improper Authorization) vulnerability that has been classified as a critical risk due to its potential for cross-tenant data manipulation and persistent content injection. Organizations using Attendize must implement immediate mitigations including enforcing strict tenant isolation scopes in all event-related API endpoints, implementing comprehensive access control validation mechanisms, and ensuring proper authorization checks are performed before any write operations are permitted. Additionally, the system should be configured to prevent cross-tenant event modification through explicit scope validation that verifies both user permissions and tenant ownership relationships before allowing any content creation or modification operations.
The remediation approach must address the root cause by implementing robust tenant isolation throughout the application's API layer, ensuring that all event-related operations explicitly validate not only user authentication but also tenant ownership and authorization scope. This includes modifying the postCreateEventQuestion method to enforce proper scope validation and implementing a comprehensive authorization framework that prevents users from accessing or modifying resources belonging to other tenants. Organizations should also consider implementing additional monitoring and audit logging for event modification activities, particularly those involving question creation and deletion operations, to detect unauthorized access attempts and maintain compliance with data protection regulations. The vulnerability underscores the critical importance of proper access control implementation in multi-tenant applications and highlights the potential consequences of inadequate isolation mechanisms in shared platform environments.