---
id: CVE-2026-57960
title: >-
  Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List
  short_id
summary: >-
  Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole
  access control, allowing unauthenticated access to retrieve full attendee
  lists including emails and personal information. Attackers with knowledge of
  the short_…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-359
vendor: HiEventsDev
product: Hi.Events
affected:
  - Hi.Events <= 1.9.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-30T14:35:31.080236Z'
exploitAvailable: true
published: '2026-06-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:42.540Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57960'
references:
  - url: 'https://github.com/HiEventsDev/Hi.Events/issues/1224'
    label: Researcher Disclosure
  - url: 'https://github.com/HiEventsDev/Hi.Events/pull/1229'
    label: Pull Request
  - url: >-
      https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id
tags:
  - cve.org
  - exploit-available
epss: 0.00419
epssPercentile: 0.36498
ingestedAt: '2026-11-08T14:51:22.313Z'
---

## Overview

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

## Affected

- `Hi.Events <= 1.9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.