CVE-2026-122325

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-122325
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122325.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-122325
Published
2026-11-05T15:11:44Z
Modified
2026-11-05T21:32:24Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
Details

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122325.json"
}
References

Affected packages

Git / github.com/fossasia/eventyay-exhibition

Affected ranges

Type
GIT
Repo
https://github.com/fossasia/eventyay-exhibition
Events
Introduced
f68888e312c220588ddc13f8bbc4bab927b5e530
Last Affected
f68888e312c220588ddc13f8bbc4bab927b5e530
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "f68888e312c220588ddc13f8bbc4bab927b5e530"
                },
                {
                    "last_affected": "f68888e312c220588ddc13f8bbc4bab927b5e530"
                }
            ],
            "source": "AFFECTED_FIELD_GIT",
            "strategy": "GitCommit"
        }
    ]
}

Affected versions

Other
f68888e312c220588ddc13f8bbc4bab927b5e530

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122325.json"