Unauthenticated Person Data Modification via IDOR

Summary

Events Made Easy (< 3.1.4) does not verify that the requester is authorized to modify the targeted record when handling an unauthenticated data-change request. It relies only on a public nonce with no per-record token or ownership check, allowing unauthenticated attackers to overwrite the personal data of any person record.