CVE-2026-57960: Hieventsdev Hi.events

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

Affected products

• Hieventsdev Hi.events: up to and including 1.9.0

Published 2026-06-29. Last modified 2026-07-14.