Executive brief
Attendize is an open-source event management and ticketing platform. A vulnerability in the attendee bulk import feature allows authenticated event organizers to inject attendees into events owned by other accounts, bypassing account boundaries and enabling cross-account data manipulation.
Technical details
An insecure direct object reference (IDOR) vulnerability exists in the postImportAttendee endpoint through commit 9289acb. The endpoint loads target events by ID without verifying ownership against the requesting organizer's account, allowing any authenticated organizer to bulk import attendees into arbitrary events. The vulnerability requires authentication but does not validate authorization (event ownership), enabling cross-account attendee injection. An attacker can manipulate event data for other organizations without detection or permission.
Affected products
- Attendize Attendize through commit 9289acb
Timeline
- 2026-08-11: disclosed