CVE-2026-50165: alf.io Auth Bypass Vulnerability

CVE-2026-50165 Overview

CVE-2026-50165 is an Improper Access Control vulnerability [CWE-284] in alf.io, an open source ticket reservation system used for conferences, trade shows, workshops, and meetups. Versions prior to 2.0-M5-2605 expose system-level configuration secrets through organization and event scoped single configuration endpoints. The endpoints validate organization or event ownership but accept an arbitrary configuration key. The lookup then returns the first matching value, including system-level configuration entries. An authenticated organization owner can read secrets intended for administrators only, such as the system API key when configured.

Critical Impact
Any authenticated organization owner can retrieve administrator-only secrets, including the system API key, enabling further compromise of the alf.io deployment.

Affected Products

alf.io versions prior to 2.0-M5-2605
Self-hosted alf.io deployments exposing organization or event scoped configuration endpoints
Multi-tenant alf.io instances where non-administrator organization owners exist

Discovery Timeline

2026-09-09 - CVE-2026-50165 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-50165

Vulnerability Analysis

The flaw resides in alf.io endpoints that return a single configuration value scoped to an organization or event. The endpoints correctly enforce that the caller owns the target organization or event. However, they treat the configuration key supplied by the caller as untrusted input without restricting which keys are valid within that scope.

When the backend resolves the configuration key, it queries a lookup that spans organization, event, and system-level configuration. The first matching value is returned to the caller. An organization owner can therefore request keys that were never intended to be visible outside the system administrator scope.

Because the system API key is stored as one of these configuration entries, an attacker with organization owner privileges can retrieve it and then act with administrator authority against the alf.io API. This transforms a limited tenant-level role into an effective global compromise of the instance.

Root Cause

The root cause is missing authorization on the configuration key itself. The endpoints validate the scope owner but not the scope of the requested key, allowing the lookup to fall through to system-level entries. This is a classic Improper Access Control pattern where authentication and coarse-grained authorization are enforced but fine-grained checks on the requested resource are absent.

Attack Vector

Exploitation requires network access to the alf.io web interface and valid organization owner credentials. The attacker calls a scoped single configuration endpoint with a target key such as the system API key identifier. The server returns the value from the shared configuration lookup. No user interaction is required, and the request pattern is indistinguishable from legitimate configuration reads at the HTTP layer.

Refer to the GitHub Security Advisory GHSA-x473-r8w6-fcq5 for the upstream description of the vulnerable endpoints.

Detection Methods for CVE-2026-50165

Indicators of Compromise

Requests from organization owner accounts to single configuration endpoints querying keys unrelated to that organization's typical operations
Access log entries showing repeated configuration key enumeration from a single authenticated session
Unexpected use of the system API key from IP addresses or clients associated with organization owner accounts
Configuration read activity immediately followed by privileged administrative API calls

Detection Strategies

Review alf.io application logs for organization or event scoped configuration reads that reference system-level keys such as the system API key identifier
Correlate configuration read events with the roles of the requesting accounts and flag reads by non-administrator roles
Alert on any successful lookup returning a secret value to an account that does not hold the administrator role

Monitoring Recommendations

Enable verbose audit logging on alf.io configuration endpoints and forward logs to a centralized SIEM or data lake
Baseline expected configuration read patterns per organization owner and alert on deviations
Monitor system API key usage for anomalous source addresses, user agents, or request volumes

How to Mitigate CVE-2026-50165

Immediate Actions Required

Upgrade alf.io to version 2.0-M5-2605 or later, which fixes the improper access control issue
Rotate the system API key and any other secrets stored in alf.io configuration after upgrading
Audit the list of organization owner accounts and remove or downgrade any that are no longer required
Review application logs for prior access to single configuration endpoints from non-administrator accounts

Patch Information

The alf.io maintainers released version 2.0-M5-2605 to address CVE-2026-50165. The fix restricts the configuration key lookup so that organization and event scoped endpoints cannot return system-level entries. Full remediation details are published in the GitHub Security Advisory GHSA-x473-r8w6-fcq5.

Workarounds

Restrict network access to the alf.io administrative and configuration endpoints to trusted operators only
Avoid storing the system API key or other administrator-only secrets in alf.io until the upgrade is applied
Limit organization owner assignments to a minimal set of trusted users while the vulnerable version remains in production

bash

# Configuration example: verify the running alf.io version and plan upgrade
grep -R "alf.io" ./build.gradle* ./pom.xml 2>/dev/null
# Upgrade target: 2.0-M5-2605 or later