The vulnerability in Attendize is an insecure direct object reference that permits any authenticated event organizer to inject attendees and orders into events owned by other accounts through the postInviteAttendee API endpoint. By supplying an event identifier that does not belong to the organizer, the server substitutes the target event without performing an ownership check, enabling the attacker to alter event details and associated financial records. The impact of leveraging this flaw is the loss of data integrity and potential financial loss across account boundaries.

This flaw affects all instances of the Attendize event management platform that have not applied the security fix contained in commit 9289acb. While specific version numbers are not listed, the vulnerability exists in every deployed release that loads the postInviteAttendee endpoint without verifying the authenticated user’s association with the target event. Organisations using the open‑source Attendize application should review their deployed code against the reference commit in the official GitHub repository.

The CVSS score of 7.1 denotes a moderate severity, and the EPSS score is not available, implying limited public exploitation data at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely weaponized. Nonetheless, an attacker who can authenticate as any event organizer can exploit the endpoint to manipulate event and financial data, which may lead to significant business disruption or monetary loss.