Unauthenticated Access Vulnerability in Hi.Events Software by Hi.Events Dev

CVE-2026-57960

What is CVE-2026-57960?

The Hi.Events application allows access to sensitive attendee information through its public check-in list endpoints. By relying solely on the 'short_id' for access control, the system permits unauthenticated users to retrieve full attendee lists, which may include personal information like emails. Attackers who possess the 'short_id' can exploit GET requests to the '/api/public/check-in-lists/{short_id}/attendees' endpoint, potentially leading to unauthorized data retrieval and the ability to create or delete check-in records without any form of authentication.

References