Attendize Event Organizers Bypass Account Boundaries via IDOR

An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into events belonging to other accounts via the postImportAttendee endpoint. The endpoint loads the target event by ID without verifying ownership against the requesting organiser account. An attacker can inject bulk attendee data into any event in the system regardless of account boundaries.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This insecure direct object reference (IDOR) vulnerability in Attendize allows authenticated event organizers to inject bulk attendee data into events they don't own by directly manipulating object references in the postImportAttendee endpoint. The vulnerability stems from missing ownership validation—the endpoint accepts an event ID without verifying that the requesting organizer controls that event. Any authenticated user can exploit this to compromise event integrity across account boundaries, potentially affecting event management platforms with multiple organizations or customers. This represents a critical privilege escalation and data integrity risk, particularly for SaaS platforms where account isolation is fundamental to multi-tenant security.

Casky's 283 matching skills help practitioners detect the attack patterns behind this CVE by mapping to MITRE ATT&CK Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Using Claude AI's extended reasoning, practitioners would identify suspicious patterns including: repeated postImportAttendee requests with varying event IDs from single organizer accounts, bulk attendee imports across logically unrelated events, API calls that reference events outside the requester's account scope, and audit logs showing attendee modifications to events with no prior authorization history. Security teams would see findings highlighting cross-account resource modification attempts, missing authorization checks in API endpoints, and the absence of object-level access control validation—enabling them to prioritize remediation and implement proper account-scoped access controls before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72547.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-72547

Casky has 283 skills that investigate the attack patterns behind CVE-2026-72547. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn