CVE-2026-122325: eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fossasia/eventyay-exhibitionto a version that resolves this vulnerability.Patch f68888e
Event History
Frequently Asked Questions
Who can exploit this issue?
An exhibitor with lead scanning enabled can exploit it. The attacker must be able to submit a pseudonymization ID or order secret for an attendee from another event while specifying that event's organizer in the API URL.
What information could be exposed?
The affected API can return attendee names, email addresses, addresses, and answers associated with the other organizer's event.
Is user interaction required for exploitation?
No. The supplied vector indicates no user interaction is required, but exploitation has high attack complexity and requires low-level privileges.