Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-122325eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API

Low 3.1

In plain English

A low-severity authorization bypass via user-controlled key in eventyay-exhibition from fossasia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 87.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

Affected products (as reported)

Vendor	Product	Versions
fossasia	eventyay-exhibition	f68888e312c220588ddc13f8bbc4bab927b5e530

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/fossasia/eventyay-exhibition/issues/343 issue-tracking
https://github.com/fossasia/eventyay-exhibition/pull/383 issue-tracking, patch
https://github.com/fossasia/eventyay-exhibition/blob/f68888e312c220588ddc13f8bbc4bab927b5e530/exhibition/api.py#L399-L470 technical-description
https://hackmd.io/@hieuPenguinnn/eventyay-exhibition-cross-event-lead-idor third-party-advisory
https://github.com/fossasia/eventyay-exhibition product
VulnCheck Advisory: eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API third-party-advisory