CVE-2026-63101 describes a missing authentication vulnerability in fossasia's open-event-server up to version 1.19.1. The vulnerability allows unauthenticated attackers to access the group followers CSV export endpoint, which does not require authentication. Attackers can enumerate group IDs by brute force, initiate an export via an unauthenticated POST request, and poll the task status endpoint until the export completes. The resulting download URL provides access to the complete member roster of the targeted group, exposing sensitive member details such as email addresses, names, join dates, and roles. This flaw represents a critical exposure of private group membership data.

The vulnerability exposes sensitive personal information of group members, including email addresses and roles, to unauthenticated attackers. This can lead to privacy violations and potential targeted attacks against exposed individuals. The high CVSS score (8.7) reflects the ease of exploitation (no authentication required) and the high confidentiality impact. There is no indication of privilege escalation or system compromise beyond data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints if possible, and monitor for unusual access patterns. Avoid exposing group follower data publicly. Follow vendor updates closely for an official fix or temporary mitigation.