Executive brief
Open Event Server, a platform used for managing events and group memberships, contains a security flaw that allows anyone on the internet to download private member lists. An attacker can access the full names, email addresses, and roles of every member in any group without needing an account or password. This exposure of personal data can lead to targeted phishing attacks, privacy breaches for group members, and reputational damage to organizations hosting events on the platform.
Technical details
A missing authentication vulnerability (CWE-306) exists in Open Event Server through version 1.19.1 due to the absence of authentication decorators on critical API endpoints. Specifically, the 'export_group_followers_csv' endpoint and the Celery task status endpoint ('/v1/tasks/<task_id>') do not require JWT or administrative credentials. An attacker can brute-force sequential group IDs, trigger a CSV export via a POST request, and poll the task endpoint to retrieve a download URL for the resulting member roster. The exported data includes PII such as email addresses and join dates. The repository was archived in May 2026, and no official patch has been released.
Affected products
- FOSSASIA Open Event Server through 1.19.1
Timeline
- 2026-05-22: other: Repository archived by owner
- 2026-07-17: disclosed: Vulnerability disclosed by VulnCheck and researcher George Chen
- 2026-07-17: advisory: NVD published CVE-2026-63101