CyberRota Analysis
AI-GeneratedAttendize is vulnerable due to an insecure direct object reference that allows authenticated event organizers to manipulate attendee and order data across different accounts through the postInviteAttendee endpoint. This flaw enables attackers to alter event details and financial records, posing significant risks to data integrity and confidentiality. Organizations using Attendize, particularly those managing multiple events and accounts, should prioritize addressing this vulnerability to prevent unauthorized data access and potential financial fraud.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders into events belonging to other accounts via the postInviteAttendee endpoint. The endpoint loads the target event by ID without scoping the query to the authenticated organiser account. An attacker can modify event data and financial records across account boundaries.