EUVD-2026-40145
GHSA-5v9v-qj76-f3m4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection PII protection
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Unauthenticated attendee PII exposure in Hi.Events through 1.9.0 lets remote attackers retrieve full attendee lists — including names, emails, and personal information — by hitting the public check-in list endpoints, which treat the check-in list's short_id as the only access control. Beyond reading data, an attacker who knows or guesses a short_id can also create and delete check-in records without authentication. No public exploit identified at time of analysis; the issue was reported by VulnCheck and is tracked via an upstream GitHub fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (vulncheck) · only source for this CVE.
CVSS VectorVendor: vulncheck
DescriptionCVE.org
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
Executive ViewAI
Hi.Events event management platform through version 1.9.0 contains an authentication bypass allowing attackers to access and modify complete attendee rosters including names, emails, and personal contact information. Organizations using Hi.Events for event management face regulatory exposure under privacy laws (GDPR, CCPA) and reputational damage from unpatched PII leakage. Containment and platform alternatives must be evaluated immediately given the absence of a vendor patch.
Within 24 hours: Inventory all Hi.Events installations and confirm versions ≤1.9.0; restrict network access to check-in list endpoints using firewall rules; enable audit logging if available. Within 7 days: Evaluate migration to alternative event management platforms (e.g., Splash, Lunchbox, or similar); implement IP whitelisting and API rate-limiting on check-in endpoints; conduct preliminary attendee notification assessment. Within 30 days: Complete migration to patched or alternative platform, or deploy compensating controls; notify affected attendees if access was confirmed.
No vendor-released patch identified at time of analysis. Interim mitigations: Implement network-layer access controls (firewall, API gateway) restricting check-in endpoints to authorized networks only; deploy IP whitelisting on all check-in URLs; place authentication proxy in front of Hi.Events; enable request rate-limiting and anomaly detection; implement comprehensive audit logging for all check-in endpoint access; consider disabling public check-in functionality until patched or platform is replaced.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB