This vulnerability is an insecure direct object reference (CWE-639) that allows any authenticated event organiser to use the postImportAttendee endpoint to load attendee data into events that belong to other accounts. The endpoint identifies the target event solely by its numeric ID and does not verify that the requesting organiser actually owns that event. As a result, an attacker can inject bulk attendee records into any event in the system, violating the principle of ownership and exposing private participant information.

The affected product is Attendize, the open‑source event management platform. The flaw exists in all releases that contain commit 9289acb or later, with no known version boundaries provided by the CNA.

The CVSS score of 7.1 signals a high severity risk, although the EPSS score is not available so the precise exploitation probability cannot be quantified. The flaw is not listed in the CISA KEV catalog. The likely attack path requires an authenticated organiser's account; the attacker simply submits an import request with the target event ID of another account’s event. No additional system privileges are needed beyond normal organiser authentication, making this a high‑impact vulnerability for multi‑tenant deployments.