PT-2026-53678 · Hieventsdev · Hi.Events

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-57960

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Hi.Events through 1.9.0 public check-in list endpoints use short id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short id can call GET /api/public/check-in-lists/{short id}/attendees to read attendee data and create or delete check-in records without authentication.

Correção

Enumeração de Fraquezas

CWE-359

Identificadores relacionados

CVE-2026-57960

Produtos afetados

Hi.Events

Referências · 4

• https://github.com/HiEventsDev/Hi.Events/pull/1229 · Nota
• https://github.com/HiEventsDev/Hi.Events/issues/1224 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57960 · Nota de Segurança
• https://vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id · Nota