CVE-2026-50165

alf.io, an open source ticket reservation system for conferences and events, contains an improper access control flaw (CWE-284) in its organization- and event-scoped "single configuration" endpoints. Although these endpoints are supposed to return only organization- or event-level settings, they accept an arbitrary configuration key and return the first match from a lookup that also includes system-level configuration, so an organization owner can request an administrator-only key such as the system API key and receive its value. An attacker needs only valid organization owner credentials (no user interaction), and gains read access to secrets intended to be restricted to administrators, which in the case of the system API key could enable further unauthorized actions against the system. Any alf.io deployment running a version prior to 2.0-M5-2605 is affected, particularly instances where organization owners are not trusted with administrator-level secrets. No public proof of concept is known, the issue is not listed in CISA's KEV, and there are no reports of exploitation in the wild.

What to do: Upgrade alf.io to version 2.0-M5-2605 or later, which fixes the lookup behavior. As interim mitigation, limit organization-owner roles to highly trusted users and rotate any configured system API key if organization owners may have had read access; also check instance logs for configuration-key requests made by non-administrator accounts.