Executive brief
Hi.Events is an event management platform used to organize events and manage ticket sales. A security flaw in the check-in system allows anyone who obtains a check-in link (such as a volunteer or staff member) to access the full list of event attendees, including their names and email addresses, without a password. Additionally, unauthorized individuals could use these links to falsely check attendees in or out, potentially disrupting event operations and compromising attendee privacy.
Technical details
Hi.Events through version 1.9.0 utilizes a 'capability-URL' pattern for its public check-in endpoints where a predictable or discoverable 'short_id' serves as the only form of access control. The affected endpoints, specifically /api/public/check-in-lists/{short_id}/attendees, lack the 'auth:api' middleware, allowing unauthenticated GET requests to return paginated attendee PII including email addresses, names, and order IDs. Furthermore, unauthenticated POST and DELETE requests to the check-in endpoints allow for the unauthorized creation or removal of check-in records. While the short_id has high entropy, the vulnerability stems from the lack of secondary authentication (like a PIN or API key) for URLs that are frequently shared with temporary staff or stored in logs. A patch was introduced in June 2024 to remove sensitive fields like email from the public resource.
Affected products
- HiEventsDev Hi.Events through 1.9.0
Timeline
- 2026-05-24: disclosed: Vulnerability reported to vendor via email
- 2026-06-17: disclosed: Public GitHub issue opened
- 2026-06-27: patched: Pull request submitted to hide attendee email from public resource
- 2026-06-29: advisory: CVE published and NVD record created