← CVE Radar
CVE-2026-122325eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.
2.3 LOWEPSS 0.22%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 2.3 | LOW | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| 3.1 | LOW | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
Details
- CVE ID
- CVE-2026-122325
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 16:17 UTC
- Weaknesses
- CWE-639 · Authorization Bypass Through User-Controlled Key
Affected Products
As published by the CNA in the CVE record.
fossasiaeventyay-exhibition1 version range
- f68888e312c220588ddc13f8bbc4bab927b5e530
References
- github.com https://github.com/fossasia/eventyay-exhibition
- github.com https://github.com/fossasia/eventyay-exhibition/blob/f68888e312c220588ddc13f8bbc4bab927b5e530/exhibition/api.py#L399-L470
- github.com https://github.com/fossasia/eventyay-exhibition/issues/343
- github.com https://github.com/fossasia/eventyay-exhibition/pull/383
- hackmd.io https://hackmd.io/@hieuPenguinnn/eventyay-exhibition-cross-event-lead-idor
- vulncheck.com https://www.vulncheck.com/advisories/eventyay-exhibition-through-commit-f68888e-cross-event-attendee-data-disclosure-via-lead-creation-api