---
id: "CVE-2026-122325"
kind: "vulnerability"
aliases: ["CVE-2026-122325"]
title: "Eventyay exhibition: exhibitors can read other organizers' attendee data"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["event-platform", "eventyay", "fossasia", "package", "self-hosted"]
not_affected_if: ["lead-scanning-disabled"]
published_at: "2026-11-05T16:17:45+00:00"
first_seen_at: "2026-11-05T16:40:02+00:00"
updated_at: "2026-11-05T16:41:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122325", "first_seen_at": "2026-11-05T16:40:02+00:00"}]
exploit_sources: []
---

# Eventyay exhibition: exhibitors can read other organizers' attendee data

The fossasia eventyay-exhibition project has an authorization bypass in its exhibitor lead creation API. An exhibitor with lead scanning enabled can read attendee names, emails, addresses and answers from other organizers' events.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployed eventyay-exhibition code is at or before commit `f68888e`

## Timeline

- 2026-11-05T16:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122325

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/eventyay-exhibition-through-commit-f68888e-cross-event-attendee-data-disclosure-via-lead-creation-api

## From the sources

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_