Missing Access Control, Any external address can call this function and arbitrarily create memorabilia collections.

Description

The createMemorabiliaCollection function lacks proper access control. Although the NatSpec comment says it's "only callable by organizer", there is no onlyOrganizer (or equivalent) modifier or internal access logic implemented to enforce this restriction.

Risk

Likelihood: H:

• Reason 1 // The function is external and publicly callable by any address.

• Reason 2 // There is no modifier or internal check to restrict access.

Impact: H:

• Impact 1 // Attackers can create unlimited or malicious collections, potentially Damaging the brand or reputation of the projectCausing user confusion or trust loss

• Impact 2 // Can lead to denial-of-service (DoS) if storage or UI logic depends on filtering through large amounts of bogus data

Proof of Concept

Recommended Mitigation

Consider creating onlyOrgnizer modifier or utilize the Acces control from OpenZeppline.