Improper Authorization in Attendize Allows Persistent Survey Question Injection

Executive Summary

This vulnerability allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events in Attendize. The issue occurs because the system does not properly isolate tenants, enabling cross-tenant writes. The injected questions cannot be removed by the victim due to incorrect ownership resolution.

Useful 0 Not Useful 0

Impact Analysis

If you are an Attendize event organizer, an attacker could inject unwanted survey questions into your events. These questions would appear mandatory for attendees, potentially disrupting your event management and collecting responses under your identity without your consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data collection, violating GDPR principles of data minimization and user consent. For HIPAA, it may compromise protected health information integrity if survey questions relate to health data, as unauthorized modifications could occur.

Useful 0 Not Useful 0

Mitigation Strategies

Update Attendize to a patched version that enforces tenant-isolation for event modifications. Review event questions for unauthorized additions and remove any suspicious entries. Restrict access to the POST /event/{event_id}/question/create endpoint to authorized users only.

Useful 0 Not Useful 0