HiEventsDev Hi.Events up to 1.9.0 check-in-lists private personal information

Summaryinfo

A vulnerability classified as problematic was found in HiEventsDev Hi.Events up to 1.9.0. Affected by this vulnerability is an unknown functionality of the file /api/public/check-in-lists. The manipulation results in private personal information. This vulnerability is reported as CVE-2026-57960. The attack can be launched remotely. No exploit exists. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in HiEventsDev Hi.Events up to 1.9.0. Affected is an unknown function of the file /api/public/check-in-lists. The manipulation with an unknown input leads to a private personal information vulnerability. CWE is classifying the issue as CWE-359. The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

The weakness was disclosed by George Chen as 1224. The advisory is available at github.com. This vulnerability is traded as CVE-2026-57960 since 06/26/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1589 by the MITRE ATT&CK project.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-40145). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• HiEventsDev

Name

• Hi.Events

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9.0

Website

• Product: https://github.com/HiEventsDev/Hi.Events/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion