Authorization Bypass in Eventyay Exhibitor Lead Creation API by Fossasia

CVE-2026-122325

What is CVE-2026-122325?

The Eventyay platform by Fossasia contains an authorization bypass vulnerability in its exhibitor lead creation API, as introduced in commit f68888e. This vulnerability allows unauthorized exhibitors to access sensitive attendee information from other organizers. By leveraging this flaw, exhibitors with lead scanning features can manipulate the URL to submit a different event's pseudonymization ID or order secret, which results in unauthorized retrieval of attendee names, emails, addresses, and answers. This significant security issue underscores the need for robust access control measures within the API to safeguard sensitive user data.

References