CVE-2026-72690: Attendize Attendize - Cross-Tenant Authorization Bypass
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{eventid}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72690?
CVE-2026-72690 has a medium severity score of 5.4.
What type of vulnerability is CVE-2026-72690?
CVE-2026-72690 is a cross-tenant authorization bypass vulnerability.
How do I fix CVE-2026-72690?
To fix CVE-2026-72690, ensure proper authorization checks are implemented for the POST /event/{event_id}/question/create endpoint.
Who is affected by CVE-2026-72690?
Authenticated remote attackers can exploit CVE-2026-72690 to manipulate other organizer's events.
What impact does CVE-2026-72690 have?
The impact of CVE-2026-72690 includes the potential injection of persistent mandatory survey questions into another organizer's events.