CVE-2026-57960: Hi.Events Unauthenticated Attendee Data Exposure via Short ID

Technical summary

The vulnerability exists in Hi.Events' public check-in list API endpoints, specifically GET /api/public/check-in-lists/{short_id}/attendees and related endpoints that manage check-in records. The application treats the short_id parameter as a sufficient access control mechanism but fails to enforce authentication or implement rate-limiting on these endpoints. Because short_id values may be predictable, derivable from public event pages, or leaked through logs and URLs, an unauthenticated attacker can enumerate valid short_ids and retrieve complete attendee rosters along with personally identifiable information (PII). Additionally, POST and DELETE operations on check-in records lack proper authorization checks, permitting record manipulation.

Business impact

Organizations using Hi.Events to manage conference registrations, ticketed events, or private gatherings face exposure of attendee PII, which creates compliance risks under GDPR, CCPA, and similar regulations. Compromised email lists become targets for phishing and social engineering campaigns. Unauthorized check-in record manipulation undermines the integrity of attendance tracking, potentially affecting event analytics, capacity planning, and security (for restricted-access events). Affected organizations may face notification obligations, regulatory fines, reputational damage, and loss of customer trust.

Affected systems

Hi.Events version 1.9.0 and all earlier versions are affected. The vulnerability specifically impacts the public check-in list functionality; organizations using Hi.Events for event management and attendee check-in workflows are at risk. Verify your installed version and scope of deployment—particularly instances exposed to the internet or used for events with sensitive attendee lists.

Exploitability

Exploitation requires only network access and knowledge of a valid short_id. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network accessibility but notes that attack complexity is high, likely because obtaining a valid short_id requires reconnaissance. However, short_ids may be embedded in publicly shared check-in links, discoverable through search engines, or leaked in unencrypted logs. Once a short_id is obtained, the attack is trivial—no special tools or authentication are required. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, but that absence does not indicate low real-world risk.

Remediation

Upgrade Hi.Events to version 1.9.1 or later (verify availability against the vendor advisory). If immediate patching is not possible, implement network-level controls: restrict access to check-in endpoints by IP range, requiring authentication at a reverse proxy or WAF layer, or disabling public check-in functionality until a patch is available. Audit logs to identify any unauthorized access to check-in endpoints using short_id values, and consider rotating or regenerating short_ids for active events.

Patch guidance

Check the Hi.Events project repository or vendor announcements for version 1.9.1 or later release notes. Apply patches in a test environment first to confirm compatibility with your event configurations. After patching, verify that check-in endpoints now require proper authentication or have implemented additional access controls beyond short_id alone. If you operate multiple Hi.Events instances, prioritize patching those managing events with sensitive attendee information.

Detection guidance

Monitor web server and application logs for repeated requests to /api/public/check-in-lists/ endpoints with varying short_id values, particularly from a single source IP. Watch for unusual patterns: high-volume attendee list queries, bulk check-in record creation or deletion by unauthenticated callers, or access to check-in endpoints during off-hours. Implement alerts on 200 OK responses from check-in endpoints when requests lack expected authentication tokens. Network-based detection tools should flag attempts to enumerate short_ids or access check-in endpoints from unexpected geographic locations.

Why prioritize this

Although marked MEDIUM severity (CVSS 6.5), this vulnerability warrants prompt attention because it directly exposes PII at scale, carries regulatory compliance implications, and requires minimal effort to exploit once a short_id is known. The high confidentiality impact and the potential for data aggregation across multiple events elevate practical risk. Organizations hosting customer, vendor, or employee events should treat this as high priority.

Risk score, explained

The CVSS 6.5 MEDIUM score reflects high confidentiality impact (full attendee data exposure) but limited integrity risk (only check-in record manipulation, not system-wide) and no availability impact. Attack complexity is rated high because a valid short_id is required; however, in real-world scenarios, short_ids may be more discoverable than the CVSS model assumes. The score does not account for PII regulation violations or reputational harm, which are material business risks.

Frequently asked questions