CVE-2026-63101 Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint
Unauthenticated attackers can export full member rosters including emails and roles from any group via an unprotected CSV export endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63101?
CVE-2026-63101 is a high-severity missing authorization vulnerability in fossasia open-event-server, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint which lacks any authentication decorator. Attackers can enumerate sequential group IDs via brute-force, trigger an export via the unauthenticated POST endpoint, then poll the unauthenticated task status endpoint until completion to retrieve a download URL containing the full member CSV.
Weakness: CWE-306
Which versions are affected by CVE-2026-63101?
How do I fix CVE-2026-63101?
No fix has been published for CVE-2026-63101 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-63101 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63101 exists.
Sources
Also known as GHSA-ggm5-8rm7-3jgc.