Threats tagged 'ghsa-p4mx-h96g-vr5p'

An authorization bypass vulnerability exists in the exhibitor lead creation API of fossasia eventyay-exhibition as of commit f68888e. This flaw allows exhibitors with lead scanning enabled to access attendee data from other organizers by submitting another event's pseudonymization ID or order secret and specifying that organizer in the URL. The exposed data includes attendee names, emails, addresses, and answers. The vulnerability has a low CVSS score of 3.1, indicating limited impact.