Alf vulnerabilities
We track 3 vulnerabilities in Alf products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 2, 2026.
Latest Alf vulnerabilities
- 9.1 Critical severity
alf.io: Incorrect Authorization
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitra
- 8.8 High severity
alf.io: Improper Authorization of Index Containing Sensitive Information
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes
- 7.6 High severity
Alf.io is a free and open source event attendance management system.
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade.