https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T01:18:24.001520+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-25635 CVE-2024-25635 — IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS 2026-10-06T01:18:24.026610+00:00

Affected: alfio-event alf.io

alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.