Open Event Server through version 1.19.1 contains a missing authentication check on the CSV export endpoint that allows an unauthenticated user to request a full download of a group’s member roster. This export returns email addresses, names, join dates, and role information for every member. The flaw is identified as CWE‑306, missing authentication, and results in a data exposure vulnerability that compromises the confidentiality of sensitive user data.

The vulnerability affects the Open Event Server product from the fossasia vendor, specifically all releases up to and including 1.19.1. Any instance running this software and exposing the default REST API endpoint may be susceptible unless the endpoint is secured by additional authentication controls.

The CVSS score of 8.7 indicates a high severity risk, but the EPSS score of less than 1% suggests that real‑world exploitation is unlikely at present. The attacker would need only network access to the server and ability to guess or brute‑force valid group identifiers. Once an export is initiated, the attacker polls the task status endpoint until the CSV download URL is available. Because the endpoint imposes no authentication, the entire process can be automated from any location that can reach the API. The vulnerability is not yet listed in the CISA KEV catalog. Overall, the combination of a high severity rating and low exploitation probability results in a moderate‑to‑high risk that must be mitigated promptly.