Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-50165

alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

CVSS 4.0 7.1 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-50165

Published

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuration" endpoints. The affected endpoints require organization or event ownership, but they accept an arbitrary configuration key and then return the first matching value from a lookup that includes system-level configuration. As a result, an organization owner can retrieve secrets intended to be administrator-only, including the system API key when it is configured. Version 2.0-M5-2605 fixes the issue.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-50165

Published

alf.io

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "alfio-event",
                    "product": "alf.io",
                    "versions": [
                        {
                            "version": "< 2.0-M5-2606",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON