Is CVE-2026-57960 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57960 being exploited in the wild.

How severe is CVE-2026-57960?

Medium severity, with a CVSS score of 6.5, published 29 June 2026.

Which products and versions are affected?

HiEventsDev Hi.Events through 1.9.0.

Is there a fix for CVE-2026-57960?

A patch was published on 2026-06-27: Pull request submitted to hide attendee email from public resource Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57960 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-57960?

Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57960: Hi.Events unauthenticated PII exposure in public check-in list

CVE-2026-57960 · Severity: medium · CVSS 6.5 · Published 2026-06-29

Hi.Events is an event management platform used to organize events and manage ticket sales. A security flaw in the check-in system allows anyone who obtains a check-in link (such as a volunteer or staff member) to access the full list of event attendees, including their names and email addresses, without a password. Additionally, unauthorized individuals could use these links to falsely check attendees in or out, potentially disrupting event operations and compromising attendee privacy.

Technologies: HiEventsDev Hi.Events. Vendors: HiEventsDev.

Quick answers

Is CVE-2026-57960 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57960 being exploited in the wild.
How severe is CVE-2026-57960?: Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?: HiEventsDev Hi.Events through 1.9.0.
Is there a fix for CVE-2026-57960?: A patch was published on 2026-06-27: Pull request submitted to hide attendee email from public resource Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57960 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-57960?: Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Hi.Events through version 1.9.0 utilizes a 'capability-URL' pattern for its public check-in endpoints where a predictable or discoverable 'short_id' serves as the only form of access control. The affected endpoints, specifically /api/public/check-in-lists/{short_id}/attendees, lack the 'auth:api' middleware, allowing unauthenticated GET requests to return paginated attendee PII including email addresses, names, and order IDs. Furthermore, unauthenticated POST and DELETE requests to the check-in endpoints allow for the unauthorized creation or removal of check-in records. While the short_id has high entropy, the vulnerability stems from the lack of secondary authentication (like a PIN or API key) for URLs that are frequently shared with temporary staff or stored in logs. A patch was introduced in June 2024 to remove sensitive fields like email from the public resource.

Affected products

HiEventsDev Hi.Events through 1.9.0

Timeline

2026-05-24: disclosed: Vulnerability reported to vendor via email
2026-06-17: disclosed: Public GitHub issue opened
2026-06-27: patched: Pull request submitted to hide attendee email from public resource
2026-06-29: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.