{"id":"CVE-2026-122325","kind":"vulnerability","aliases":["CVE-2026-122325"],"related":[],"title":"Eventyay exhibition: exhibitors can read other organizers' attendee data","description":"fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.","summary":"The fossasia eventyay-exhibition project has an authorization bypass in its exhibitor lead creation API. An exhibitor with lead scanning enabled can read attendee names, emails, addresses and answers from other organizers' events.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["event-platform","eventyay","fossasia","package","self-hosted"],"not_affected_if":["lead-scanning-disabled"],"how_to_check":"- Check whether the deployed eventyay-exhibition code is at or before commit `f68888e`","fix":null,"status":"open","published_at":"2026-11-05T16:17:45+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","triaged_at":"2026-11-05T16:41:50+00:00","updated_at":"2026-11-05T16:41:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T16:41:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Eventyay exhibition: exhibitors can read other organizers' attendee data","impact":"medium","summary":"The fossasia eventyay-exhibition project has an authorization bypass in its exhibitor lead creation API. An exhibitor with lead scanning enabled can read attendee names, emails, addresses and answers from other organizers' events.","audience":"businesses","category":"package","nicknames":[],"who_cares":["eventyay","fossasia","self-hosted","event-platform"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"exhibitor reads other organizers' attendee personal data","analyst_note":"Confirm the fixed version or commit from the NVD entry and the vulncheck advisory; the sources only name commit f68888e as the affected bound.","how_to_check":"- Check whether the deployed eventyay-exhibition code is at or before commit `f68888e`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["lead-scanning-disabled"],"who_is_affected":"Organizers who run eventyay-exhibition with exhibitor lead scanning enabled are exposed, because exhibitors can submit another event's pseudonymization id or order secret while naming that organizer in the URL. Installations that do not use exhibitor lead scanning, or that run a later build, can likely skip it. unknown for the exact affected version range beyond the commit reference.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4279,"output_tokens":544,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-122325':12A,15A '-2026':11A,14A 'access':81C 'address':52B,113C 'allow':78C 'anoth':93C 'answer':54B,115C 'api':40B,76C 'attende':8A,49B,84C,110C 'author':33B,68C 'bypass':34B,69C 'commit':64C 'contain':66C 'creation':39B,75C 'cve':10A,13A 'data':9A,85C 'email':51B,112C 'enabl':46B,90C 'event':17B,58B,94C 'event-platform':16B 'eventyay':1A,19B,28B,61C 'eventyay-exhibit':27B,60C 'exhibit':2A,29B,62C 'exhibitor':3A,37B,42B,73C,79C,86C 'f68888e':65C 'fossasia':20B,26B,59C 'host':24B 'id':97C 'lead':38B,44B,74C,88C 'name':50B,102C,111C 'order':99C 'organ':7A,57B,83C,104C 'packag':21B 'platform':18B 'project':30B 'pseudonym':96C 'read':5A,48B 'retriev':109C 'scan':45B,89C 'secret':100C 'self':23B 'self-host':22B 'submit':92C 'url':107C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Organizers who run eventyay-exhibition with exhibitor lead scanning enabled are exposed, because exhibitors can submit another event's pseudonymization id or order secret while naming that organizer in the URL. Installations that do not use exhibitor lead scanning, or that run a later build, can likely skip it. unknown for the exact affected version range beyond the commit reference.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eventplatform","eventyay","fossasia","low","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T16:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122325","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122325","severity":null,"published_at":"2026-11-05T16:17:45+00:00","modified_at":"2026-11-05T16:17:45+00:00","first_seen_at":"2026-11-05T16:40:02+00:00","fetched_at":"2026-11-05T16:40:02+00:00","note":null}],"documents":[{"id":77627,"url":"https://www.vulncheck.com/advisories/eventyay-exhibition-through-commit-f68888e-cross-event-attendee-data-disclosure-via-lead-creation-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}