Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-72547: Attendize lets logged‑in organizers add attendees to other users’ events
CVE-2026-72547 · published 2 months ago
Summary
The Attendize event‑management system lets a signed‑in organizer upload a list of attendees to any event, even if the event belongs to a different account. This means a malicious organizer could insert or alter attendee data in other people’s events, potentially causing confusion or fraud. Apply the latest software update from the vendor and limit who can use the bulk‑import feature until the fix is in place.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| attendize | attendize | <= 9289acb |
Original advisory text
Attendize Attendize - Insecure Direct Object Reference
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.
References
- https://github.com/Attendize/Attendize Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72547... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-72547 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published11 Aug 2026
Updated3 Nov 2026
First seen11 Aug 2026
Track software like this
Free during beta