CVE-2026-122325: Fossasia eventyay-exhibition

Summary

Remote attackers with low-privilege exhibitor accounts (lead scanning enabled) can reach a flaw in fossasia eventyay-exhibition through commit f68888e's lead creation API. By submitting another event's pseudonymization ID or order secret while naming that organizer in the URL, they can read other organizers' attendee names, emails, addresses, and answers.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

cve.now Index

5Pcve.now Index 5 of 100 · methodology v3 · provisional

Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
Exposure3/25Reachable over the network · Unknown: No advisory context yet
Reach?/20Unknown. No tracked technology or package matched
Severity2.3/10CVSS 2.3
No patch0/5No signal

What would change the score

Would score about 60 if added to CISA KEV
Would score about 55 if CISA's SSVC rates exploitation active
Would score about 24 if advisories confirm default setups are exposed

How the score works · Leaderboard

What to do

Apply the patch listed under Evidence.

Timeline

Nov 5, 2026, 3:11 PM UTCCVE published
Nov 5, 2026, 3:23 PM UTCFirst seen by cve.now

Affected versions

fossasia eventyay-exhibition
Version range not reported

Evidence 6

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API