CVE-2026-57960 Details
Description
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
A vulnerability in Hi.Events versions through 1.9.0 allows unauthenticated access to attendee personally identifiable information (PII) through public check-in list endpoints. The vulnerability arises because the check-in list short_id is used as the sole access control. Attackers who know the short_id can retrieve full attendee lists, including email addresses and personal information, by calling the appropriate API endpoint. Additionally, the same short_id can be used to create or delete check-in records without authentication.
Event organizers can be advised to update to Hi.Events version 1.9.0 or later, where this vulnerability has been addressed. For those using earlier versions, a temporary measure could be to manually remove email addresses from the public check-in resources.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2026CISA-ADP
Assessed Jun 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HiEventsDev/Hi.Events/issues/1224 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/HiEventsDev/Hi.Events/issues/1224 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/HiEventsDev/Hi.Events/pull/1229 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hi.Events | <= 1.9.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2026 | New CVE Received | [email protected] |