CVE-2026-72547: Attendize Auth Bypass Vulnerability

CVE-2026-72547 Overview

CVE-2026-72547 is an insecure direct object reference (IDOR) vulnerability in Attendize event management software through commit 9289acb. The flaw resides in the postImportAttendee endpoint, which loads the target event by ID without verifying ownership against the requesting organiser account. Any authenticated event organiser can bulk import attendees into events belonging to other accounts. Attackers can inject arbitrary bulk attendee data across account boundaries. The weakness is classified as [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can bulk-inject attendee records into any event across tenant boundaries, corrupting event data and enabling downstream fraud or spam campaigns targeting legitimate attendee lists.

Affected Products

Attendize open source event ticketing platform
Attendize builds through commit 9289acb
Deployments exposing the postImportAttendee endpoint to authenticated organisers

Discovery Timeline

2026-08-11 - CVE-2026-72547 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72547

Vulnerability Analysis

Attendize allows event organisers to bulk import attendee lists into their own events through the postImportAttendee endpoint. The endpoint accepts an event identifier supplied by the client and loads the corresponding event record without validating that the authenticated organiser owns that event.

Because the authorization check is missing, an attacker with a valid organiser account can substitute any event ID belonging to another tenant. The application then processes the bulk import against the target event as if the request were legitimate. This constitutes a classic horizontal privilege escalation across tenant boundaries in a multi-tenant SaaS deployment.

The vulnerability affects data integrity across the platform. Attackers can inject fabricated attendee records, pollute mailing lists, and undermine the accuracy of registration data used for check-in and revenue reconciliation.

Root Cause

The root cause is a missing ownership check between the authenticated organiser session and the event referenced by the request parameter. The controller relies on client-supplied event identifiers without cross-referencing them against the organiser's accessible event set. This pattern maps directly to [CWE-639] Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires only a low-privileged authenticated organiser account and network access to the application. The attacker enumerates or guesses target event IDs, then issues a crafted POST request to postImportAttendee referencing an event ID outside their account. The server accepts the bulk import payload and writes attendee records into the victim event.

No user interaction from the victim organiser is required. Refer to the Attendize GitHub repository for endpoint source code and reproduction context.

Detection Methods for CVE-2026-72547

Indicators of Compromise

Unexpected attendee records appearing in events without corresponding organiser-initiated imports.
POST requests to postImportAttendee where the authenticated session's organiser ID does not match the event owner.
Bulk attendee creation events with mismatched source IP addresses or user agents relative to the event owner's normal activity.

Detection Strategies

Correlate application audit logs of import operations with the authenticated user's owned event list to surface cross-tenant access.
Alert on high-volume attendee creation from a single organiser account touching multiple distinct event IDs in a short window.
Review database records for attendee entries whose created_by metadata does not align with the event's owning account.

Monitoring Recommendations

Enable verbose logging on the postImportAttendee controller including authenticated user ID, target event ID, and event owner ID.
Forward Attendize web server and application logs to a centralized SIEM for anomaly analysis.
Track baseline import behavior per organiser and alert on statistical deviations.

How to Mitigate CVE-2026-72547

Immediate Actions Required

Restrict access to the Attendize administrative interface to trusted networks until a patched build is deployed.
Audit all recent bulk attendee imports and validate them against legitimate organiser activity.
Revoke or rotate organiser credentials suspected of enumeration or abuse.

Patch Information

No vendor-supplied patch has been referenced in the NVD entry at publication time. Monitor the Attendize GitHub repository for commits addressing ownership validation on the postImportAttendee endpoint. Operators maintaining forks should add an authorization check that verifies the authenticated organiser owns the event referenced by the request before invoking the import handler.

Workarounds

Apply a local code change enforcing that the event loaded by postImportAttendee belongs to the authenticated organiser's account.
Deploy a web application firewall rule that blocks requests to postImportAttendee when the referenced event ID is not present in the requesting session's authorized event list.
Limit organiser account creation to vetted users and require administrative approval for new tenants.

bash

# Example WAF-style pseudo-rule (adapt to your stack)
# Reject postImportAttendee requests where event_id is not in the session's owned_events
if $request_uri ~ "/postImportAttendee" && $arg_event_id not in $session_owned_events {
    return 403;
}