---
id: CVE-2026-122325
title: >-
  eventyay-exhibition through commit f68888e Cross-Event Attendee Data
  Disclosure via Lead Creation API
summary: >-
  fossasia eventyay-exhibition through commit f68888e contains an authorization
  bypass vulnerability in the exhibitor lead creation API that allows exhibitors
  to access other organizers' attendee data. Exhibitors with lead scanning
  enabled…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: fossasia
product: eventyay-exhibition
affected:
  - eventyay-exhibition f68888e312c220588ddc13f8bbc4bab927b5e530
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T15:11:44.140Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122325'
references:
  - url: 'https://github.com/fossasia/eventyay-exhibition/issues/343'
  - url: 'https://github.com/fossasia/eventyay-exhibition/pull/383'
  - url: >-
      https://github.com/fossasia/eventyay-exhibition/blob/f68888e312c220588ddc13f8bbc4bab927b5e530/exhibition/api.py#L399-L470
  - url: 'https://hackmd.io/@hieuPenguinnn/eventyay-exhibition-cross-event-lead-idor'
  - url: 'https://github.com/fossasia/eventyay-exhibition'
  - url: >-
      https://www.vulncheck.com/advisories/eventyay-exhibition-through-commit-f68888e-cross-event-attendee-data-disclosure-via-lead-creation-api
    label: >-
      VulnCheck Advisory: eventyay-exhibition through commit f68888e Cross-Event
      Attendee Data Disclosure via Lead Creation API
tags:
  - cve.org
ingestedAt: '2026-11-05T21:36:00.891Z'
epss: 0.00223
epssPercentile: 0.13005
---

## Overview

fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another event's pseudonymization id or order secret while naming that organizer in the URL to retrieve attendee names, emails, addresses and answers.

## Affected

- `eventyay-exhibition f68888e312c220588ddc13f8bbc4bab927b5e530`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.