Description

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T13:20:39.230Z",
  "pubdate": "2026-08-10T13:20:39.230Z",
  "executiveSummary": "An improper authorization vulnerability exists in Attendize up to commit 9289acb, specifically within the event question creation functionality. This security flaw allows an authenticated remote attacker to perform cross-tenant writes by injecting persistent mandatory survey questions into events belonging to other organizers. The primary impact involves unauthorized modification of external event structures, forcing victims to display attacker-controlled mandatory questions that cannot be purged through standard administrative interfaces due to account-scoped access controls. The vulnerability affects the Attendize platform and poses significant integrity risks to multi-tenant deployments by breaking isolation boundaries between distinct organizer accounts. Exploitation requires an authenticated user session to interact with the application endpoints, enabling a malicious tenant to target arbitrary event identifiers across tenant boundaries without requiring elevated administrative privileges within the victim's tenant scope.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate tenant-isolation enforcement within the application logic governing event questions. Specifically, the postCreateEventQuestion method responsible for processing question creation requests fails to apply the necessary tenant-isolation scope when loading the target event. Because the application queries and loads the target event record without validating that the authenticated user possesses administrative or ownership rights over that specific event entity, an authorization bypass occurs.\nThe attack flow proceeds as follows. First, an authenticated attacker establishes a valid session within the Attendize platform under their own tenant account. Next, the attacker formulates an HTTP POST request targeted at the endpoint POST /event/{event_id}/question/create, supplying an arbitrary {event_id} belonging to a different organizer's event, along with the payload defining the persistent mandatory survey question. Because the vulnerable postCreateEventQuestion function lacks tenant-isolation scoping during the event retrieval phase, the application processes the request and successfully persists the attacker-supplied question into the foreign event record.\nPost-exploitation impact includes persistent data tampering and denial-of-service characteristics regarding data management. The injected mandatory question becomes permanently embedded in the victim organizer's event workflow. Because the victim's account-scoped delete path restricts deletion routines to questions strictly owned within the victim's tenant context, the victim account is unable to resolve, locate, or remove the maliciously injected question through the standard application interface. Network exposure is remote via standard HTTP/HTTPS protocols, and the vulnerability relies on authenticated access combined with missing function-level and object-level access controls."
}