CVE-2026-57960Medium· 6.5▾ TwilightPoC availableHi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
Hi.Events <= 1.9.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-60118Medium· 5.3Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
CVE-2026-60119Medium· 5.4Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection
CVE-2021-22876Medium· 5.3curl 7.1.1 to and including 7.75.0 is vulnerable to an "Exposure of Private Personal Information to an Unauthorized Actor" by leaking credentials in the HTTP Referer: header
CVE-2020-37173High· 7.5AVideo Platform 8.1 - Information Disclosure (User Enumeration)
CVE-2026-39372Medium· 4.9InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments
CVE-2026-53497Medium· 5.3CrossWatch (CW) is a synchronization engine