CVE-2026-57960: Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-359

Description

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

Affected products

HiEventsDev Hi.Events: through 1.9.0

References

https://github.com/HiEventsDev/Hi.Events/issues/1224
https://github.com/HiEventsDev/Hi.Events/pull/1229
https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id
https://github.com/HiEventsDev/Hi.Events/issues/1224

Get alerted when CVE-2026-57960 or the next vulnerability affects your stack