CVE-2026-122325 · Package
NO FIX YET
The fossasia eventyay-exhibition project has an authorization bypass in its exhibitor lead creation API. An exhibitor with lead scanning enabled can read attendee names, emails, addresses and answers from other organizers' events.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizers who run eventyay-exhibition with exhibitor lead scanning enabled are exposed, because exhibitors can submit another event's pseudonymization id or order secret while naming that organizer in the URL. Installations that do not use exhibitor lead scanning, or that run a later build, can likely skip it. unknown for the exact affected version range beyond the commit reference.
Not affected if lead-scanning-disabled
Who cares event-platform, eventyay, fossasia, self-hosted
f68888eNo fix yet, per the sources.
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.