CVE-2026-72546 Attendize CVE debrief

Who should care

Organisations using Attendize for event management, particularly those with multiple accounts or high-value events, should verify their instance's security and monitor for suspicious activity. This includes event organisers, financial teams, and security personnel who may be impacted by the potential modification of event data and financial records.

Technical summary

The postInviteAttendee endpoint in Attendize through commit 9289acb is vulnerable to insecure direct object reference. This allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts. The endpoint fails to scope the query to the authenticated organiser account, enabling attackers to modify event data and financial records across account boundaries. This vulnerability can be addressed by securing the endpoint and ensuring proper access controls are in place.

Defensive priority

Authenticated attackers may inject attendees and orders into events across account boundaries, allowing modification of event data and financial records.

Recommended defensive actions

• Verify event organiser account permissions and access controls
• Restrict postInviteAttendee endpoint access to authorised accounts
• Monitor event data and financial records for suspicious activity
• Implement scoping of queries to authenticated organiser accounts
• Review and update Attendize to commit 9289acb or later
• Conduct a thorough review of event management systems for potential vulnerabilities
• Implement additional monitoring and logging to detect suspicious activity

Evidence notes

The CVE record indicates an insecure direct object reference vulnerability in Attendize through commit 9289acb. The postInviteAttendee endpoint allows authenticated event organisers to inject attendees and orders into events belonging to other accounts. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.