CVE-2026-72690 — Attendize Attendize - Cross-Tenant Authorization Bypass
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another …
Published: 2026-08-10 · CVSS: 5.4 · CVSS 3.1
An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7