CVE-2026-72690: Attendize

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim because the victim's account-scoped delete path cannot resolve a question owned by another tenant.

Affected products

• Attendize Attendize

Published 2026-08-10. Last modified 2026-08-26.