Alfio-event vulnerabilities
We track 4 vulnerabilities in Alfio-event products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Alfio-event vulnerabilities
- 7.1 High severity
alf.io: Improper Access Control
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organizat
- 9.1 Critical severity
alf.io: Incorrect Authorization
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitra
- 8.8 High severity
alf.io: Improper Authorization of Index Containing Sensitive Information
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes
- 7.6 High severity
Alf.io is a free and open source event attendance management system.
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade.