eventyay‑exhibition allows an exhibitor who has lead scanning enabled to exploit an authorization bypass in the lead creation API. By supplying a pseudonymization ID or order secret from another event, along with that event’s organizer name in the request URL, the API will return attendees’ personal information such as names, emails, addresses and questionnaire responses. This represents a confidentiality violation that exposes sensitive personal data across event boundaries.

The vulnerability affects installations of fossasia eventyay‑exhibition that contain the commit f68888e and any earlier revisions that have not applied the patch introduced in pull request 383. All publishers using the lead creation API and granting exhibitors lead scanning permissions are potentially exposed.

The CVSS score is 2.3, indicating low overall severity, and the EPSS score is not available; the issue is not listed in the CISA KEV catalog. The attack vector is a local API call that requires the exhibitor to be authenticated and possess lead scanning rights. While the attack does not allow arbitrary code execution and the risk is confined to data disclosure, the confidentiality impact across events can be significant if an exhibitor is malicious. Overall, the vulnerability poses a low‑to‑moderate risk, but it is recommended to address it promptly.