The issue occurs when someone is scheduling a meeting via the meeting scheduler. In HubSpot, a new contact is created with email address and name.
However, when an adversarial third party enters a known email address, this attacker can change the name of the contact in the contact list through the meeting scheduler.
E.g. I set up a meeting as example@gmail.com, which I do not control, with “name1 surname1”, an existing contact’s name will be changed in the contact list without permission.
Essentially, anyone can input an email address they do not own or control, and if that email corresponds to an existing contact in list, they can overwrite the contact’s information. This introduces the risk of data manipulation or misuse, making it difficult for the organisation to detect or prevent such changes.
The core issue is that the meeting scheduler does not verify ownership of the email address. Without an authentication or verification step, malicious actors could exploit this by inputting known email addresses and altering associated contact properties, which would be hard for the organisation to identify until the damage is done.
I understand that a two-factor meeting scheduler may create a bit too much overhead and scare potential customers.
But to mitigate this risk, you may want to consider additional safeguards, such as Unique Meeting URLs with Tokenization. Instead of allowing open-access meeting schedulers, assign each user or invitee a unique, tokenised URL. This ensures that only the intended recipient, who has access to the specific link, can book the meeting. It would add an extra layer of protection by tying meeting requests to specific email recipients and preventing tampering with shared contact data.
This would greatly reduce the risk of unauthorized updates to contact records and protect against misuse of the scheduler.
Alternatively, you could have a setting to require email verification during a meeting link booking.
cc/ @Hallie