CVE-2026-72546: Attendize Auth Bypass Vulnerability

CVE-2026-72546 Overview

CVE-2026-72546 is an insecure direct object reference (IDOR) vulnerability in Attendize, an open-source attendance and event management tool. The flaw exists in the postInviteAttendee endpoint through commit 9289acb. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. Any authenticated event organiser can inject attendees and orders into events owned by other accounts. This enables cross-tenant modification of event data and financial records. The vulnerability is classified under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated organisers can manipulate attendee lists and financial order records across account boundaries, corrupting event integrity for unrelated tenants.

Affected Products

Attendize event management platform
Attendize through commit 9289acb
Deployments exposing the postInviteAttendee endpoint

Discovery Timeline

2026-08-11 - CVE-2026-72546 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72546

Vulnerability Analysis

CVE-2026-72546 is an insecure direct object reference vulnerability affecting the Attendize postInviteAttendee endpoint. The endpoint accepts an event identifier from the request and retrieves the corresponding event record. It performs no ownership check against the authenticated organiser's account. As a result, an attacker with any valid organiser account can supply arbitrary event IDs. The application then treats the attacker as authorised to invite attendees and generate orders for events owned by other tenants.

The impact extends beyond simple data disclosure. Injected attendees and orders modify financial records, which can distort ticket counts, revenue reporting, and reconciliation for legitimate event owners. Because Attendize is a multi-tenant platform, the boundary between organiser accounts is a core security assumption. This flaw invalidates that assumption at the invitation endpoint.

Root Cause

The root cause is missing authorisation logic around a user-controlled key. The postInviteAttendee controller loads the event by primary key without joining or filtering by the authenticated account_id. This maps directly to [CWE-639]. The application confuses authentication with authorisation, granting any logged-in organiser implicit rights to any event object referenced by ID.

Attack Vector

An attacker first registers or authenticates as an event organiser on the target Attendize instance. The attacker then issues a POST request to the postInviteAttendee endpoint, substituting the event_id parameter with the identifier of a victim organiser's event. Event IDs are typically sequential integers, making enumeration trivial. The server processes the invitation and creates attendee and order records under the victim's event without validating ownership. No user interaction from the victim is required. Refer to the Attendize GitHub repository for source-level context on the affected endpoint.

Detection Methods for CVE-2026-72546

Indicators of Compromise

Attendee or order records associated with an account_id that differs from the parent event's owning account.
POST requests to postInviteAttendee where the session organiser does not own the referenced event_id.
Unexplained attendee entries or ticket orders appearing on events shortly after unrelated account activity.
Sequential probing of event_id values from a single authenticated session.

Detection Strategies

Correlate web access logs for the postInviteAttendee route with database ownership relationships between the requesting user and the target event.
Deploy application-layer rules that reject invite requests when the session account_id does not match the event's owning account.
Baseline typical invitation volume per organiser and alert on anomalous spikes or cross-account access patterns.

Monitoring Recommendations

Enable verbose audit logging for all attendee and order creation events, including the acting user identifier and target event owner.
Forward Attendize application and web server logs to a centralised SIEM for continuous correlation and long-term retention.
Review order and attendee tables periodically for tenant boundary violations using automated integrity checks.

How to Mitigate CVE-2026-72546

Immediate Actions Required

Audit the Attendize deployment against commit 9289acb and determine whether the postInviteAttendee endpoint enforces ownership scoping.
Restrict access to the Attendize organiser panel to trusted users while a fix is applied, reducing the pool of accounts that can abuse the endpoint.
Review existing attendee and order records for cross-account anomalies and quarantine suspicious entries.

Patch Information

No vendor-issued patch reference is included in the NVD entry at the time of publication. Monitor the Attendize GitHub repository for commits that add account-scoped queries to the postInviteAttendee controller. Apply any upstream fix and rebuild affected deployments once available.

Workarounds

Add a server-side authorisation check that verifies the authenticated organiser owns the referenced event before processing the invitation.
Introduce middleware that filters event queries by the session account_id for all organiser-facing endpoints.
Replace sequential integer event identifiers with unguessable UUIDs to reduce enumeration risk, while retaining server-side ownership checks as the primary control.

bash

# Configuration example
# Pseudocode guard to add before processing postInviteAttendee
# if (event.account_id !== session.account_id) {
#     return response(403, 'Forbidden');
# }