Which versions of Hi.Events are affected by CVE-2026-57960?

Hi.Events event management platform through version 1.9.0 contains an authentication bypass allowing attackers to access and modify complete attendee rosters including names, emails, and personal…

How to fix or mitigate CVE-2026-57960?

Within 24 hours: Inventory all Hi.Events installations and confirm versions ≤1.9.0; restrict network access to check-in list endpoints using firewall rules; enable audit logging if available. Within 7 days: Evaluate migration to alternative event management platforms (e.g., Splash, Lunchbox, or similar); implement IP whitelisting and API rate-limiting on check-in endpoints; conduct preliminary attendee notification assessment. Within 30 days: Complete migration to patched or alternative platform, or deploy compensating controls; notify affected attendees if access was confirmed.

Hi.Events CVE-2026-57960

Q: What is the CVSS score of CVE-2026-57960?

CVE-2026-57960 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40145 HIGH

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-06-29 disclosure@vulncheck.com

GHSA-5v9v-qj76-f3m4

Information Disclosure

8.3

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 18:36 vuln.today

DescriptionCVE.org

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

AnalysisAI

Unauthenticated attendee PII exposure in Hi.Events through 1.9.0 lets remote attackers retrieve full attendee lists — including names, emails, and personal information — by hitting the public check-in list endpoints, which treat the check-in list's short_id as the only access control. Beyond reading data, an attacker who knows or guesses a short_id can also create and delete check-in records without authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours: Inventory all Hi.Events installations and confirm versions ≤1.9.0; restrict network access to check-in list endpoints using firewall rules; enable audit logging if available. …

Threat intelligence, references, and detailed analysis are available after sign-in.