CyberRota Analysis
AI-GeneratedAttendize is vulnerable to an improper authorization flaw that allows authenticated remote attackers to inject persistent mandatory survey questions into events belonging to other organizers. This vulnerability can lead to unauthorized modifications of event content, as the injected questions cannot be deleted by the affected organizers due to tenant-isolation issues. Organizations using Attendize should prioritize addressing this vulnerability to prevent potential misuse and maintain the integrity of their event management processes.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.