CVE-2026-72690: Attendize Auth Bypass Vulnerability

CVE-2026-72690 Overview

CVE-2026-72690 is an improper authorization vulnerability [CWE-639] in Attendize, an open-source ticket-selling and event management platform. The flaw exists through commit 9289acb and allows an authenticated attacker to inject persistent, mandatory survey questions into events owned by other organizers. The postCreateEventQuestion method loads target events without applying the tenant-isolation scope, permitting cross-tenant writes via the POST /event/{event_id}/question/create endpoint.

Critical Impact
Any authenticated organizer can tamper with another tenant's events by planting mandatory survey questions the victim organizer cannot delete, because the victim's account-scoped delete path cannot resolve records owned by another tenant.

Affected Products

Attendize event ticketing platform through commit 9289acb
Self-hosted Attendize deployments serving multiple organizers
Multi-tenant Attendize instances exposing the event question API

Discovery Timeline

2026-08-10 - CVE-2026-72690 published to the National Vulnerability Database
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72690

Vulnerability Analysis

Attendize supports multiple event organizers within a single deployment. Each organizer operates as a tenant and should only be able to modify resources scoped to their own account. The postCreateEventQuestion controller action handles creation of survey questions attached to an event.

The controller resolves the target event using the untrusted event_id path parameter without joining the query against the authenticated organizer's account identifier. As a result, an authenticated attacker can submit a crafted POST /event/{event_id}/question/create request referencing any event ID in the system. The controller writes the new question record and persistently associates it with the victim's event.

The attack yields a compounding effect. The injected question is marked mandatory, so attendees registering for the victim's event must answer attacker-controlled prompts. The victim organizer cannot remove the record because the corresponding delete route filters questions by owning account, and the injected question resolves to a foreign tenant.

Root Cause

The root cause is a missing tenant-isolation predicate in the event lookup performed by postCreateEventQuestion. Access control depends on ownership scoping applied at the model or query layer, and that scope is omitted on the write path. This matches the [CWE-639] pattern of authorization based on user-supplied keys without server-side ownership validation.

Attack Vector

Exploitation requires only a valid organizer account and knowledge or enumeration of a target event_id. The attacker sends an authenticated HTTP POST to /event/{event_id}/question/create with a chosen question title, type, and the is_required flag set. The server persists the record under the victim's event, and the attacker retains no need for further access. The endpoint is reachable over the network with low attack complexity.

No verified public proof-of-concept code is available. See the GitHub Attendize Repository for the affected controller source.

Detection Methods for CVE-2026-72690

Indicators of Compromise

POST requests to /event/{event_id}/question/create where the authenticated session's organizer identifier does not match the owning account of the referenced event.
New event_question database rows whose created_by or session-associated user identifier differs from the event's owning organizer.
Unexpected mandatory survey questions appearing on event registration forms without a corresponding audit trail entry from the legitimate organizer.
Attendee complaints about unfamiliar or suspicious required questions during ticket checkout.

Detection Strategies

Deploy application-layer logging that captures the acting user ID, target event_id, and event owner ID on every question-creation request, then alert on mismatches.
Add a database integrity check that flags event_question records whose creating user does not own the parent event.
Baseline the normal rate of question-creation events per organizer and alert on outliers targeting events that user has never previously modified.

Monitoring Recommendations

Forward Attendize web server and application logs to a centralized analytics platform for correlation across tenants.
Monitor authentication logs for organizer accounts that begin enumerating sequential event_id values.
Review event configuration diffs on a scheduled cadence to identify unauthorized additions of required questions.

How to Mitigate CVE-2026-72690

Immediate Actions Required

Audit all event_question records and remove entries whose creator does not match the parent event's owning organizer.
Restrict access to the Attendize application to trusted organizer accounts until a patched build is deployed.
Rotate credentials for any organizer accounts suspected of participating in cross-tenant writes.
Notify affected organizers whose events contain injected questions so they can validate attendee data collected under the mandatory prompts.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Track the GitHub Attendize Repository for commits that add tenant-scoping to the postCreateEventQuestion handler and the corresponding delete path. Apply upstream fixes as soon as they are merged and validated.

Workarounds

Patch postCreateEventQuestion locally to load the target event through the organizer-scoped query builder used by other controller actions.
Add a middleware check that compares the authenticated organizer ID against the event owner for every route containing an event_id parameter.
Introduce a privileged administrative delete path that bypasses tenant scoping so victim organizers can remove foreign-owned questions from their events.

bash

# Configuration example
# Temporary web server rule to block the vulnerable endpoint until patched
# nginx example - return 403 for question creation until code fix is deployed
location ~ ^/event/[0-9]+/question/create$ {
    return 403;
}