Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72546Attendize Attendize - Insecure Direct Object Reference

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in Attendize from Attendize. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 79.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.

Affected products (as reported)

Vendor	Product	Versions
Attendize	Attendize	0 – through 9289acb

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

Project Repository