An improper authorization flaw in Attendize allows an authenticated attacker to create persistent mandatory survey questions in another organizer’s events. The vulnerability arises because the postCreateEventQuestion method loads the target event without applying tenant isolation, so the attacker can write data across tenant boundaries. The injected question remains because the victim’s account‑scoped delete path cannot resolve questions owned by another tenant, resulting in unauthorized data persistence.

The affected product is Attendize: Attendize. The vulnerability is tied to commit 9289acb; because no specific version list is provided, any deployed instance that has incorporated this commit or later without applying a fix is potentially vulnerable. Users should determine whether their Attendize installation predates or includes the fix referenced by this commit.

The CVSS score of 5.4 indicates moderate severity. Exploitation requires authentication to the server and the ability to call the POST /event/{event_id}/question/create endpoint. Since the attacker can target any organizer event, the attack surface is wide within the organization. The EPSS score is not available and the weakness is not listed in KEV, so while the vulnerability is technically exploitable, there is limited evidence of widespread exploitation at present. However, the impact of injected survey questions that cannot be removed by the rightful owner is significant for data integrity and auditability.