This is not a typical authorization bypass. The vulnerability in the postCreateEventQuestion method creates a permanent contamination that your standard incident response procedures cannot address.
The core issue is asymmetric tenant isolation: the write path loads the target event without enforcing tenant boundaries, but the delete path—presumably written later with correct tenant scoping—cannot resolve or remove questions created outside the attacker's tenant context. This means an authenticated attacker can inject questions into another organization's event configuration, but the victim cannot delete them through any legitimate code path. Your delete endpoint operates within account-scoped query context and literally cannot see questions belonging to another tenant. Remediation requires direct database intervention—manual SQL deletion, database console access, or a privileged admin tool operating outside normal tenant boundaries.
The CVSS 7.1 score significantly undersells operational impact. This is functionally a targeted denial-of-service against event organizers. The attacker need not exploit a technical misconfiguration; any compromised account, shared credential, or insider threat becomes a weapon.
Two detection challenges compound the problem. First, if read operations correctly enforce tenant scoping—typical for hardened systems—then attackers operate blind: they have cross-tenant write capability but no legitimate mechanism to verify success from their own account context. They cannot confirm injection succeeded, which means exploitation may be assumed rather than confirmed during incident investigation. Second, victims may only discover the contamination when event attendees report seeing questions they didn't create—an unusual symptom easily dismissed or misattributed.
Update operations for existing questions likely suffer the same tenant isolation failure. The asymmetric pattern suggests create and update were written during the pre-isolation development era, while delete was retrofitted with correct tenant scoping. Audit your CRUD operations for consistent tenant enforcement, particularly event updates, attendee modifications, and question modifications. Version control archaeology—examining when each endpoint was committed—can reveal which operations likely share this architectural gap.