# CVE-2026-57960: Hi.Events unauthenticated PII exposure in public check-in list

Source: https://junglewise.ai/threats/cve-2026-57960-hi-events-unauthenticated-pii-exposure-in-public-check-in-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-57960 · Severity: medium · CVSS 6.5 · Published 2026-06-29

Hi.Events is an event management platform used to organize events and manage ticket sales. A security flaw in the check-in system allows anyone who obtains a check-in link (such as a volunteer or staff member) to access the full list of event attendees, including their names and email addresses, without a password. Additionally, unauthorized individuals could use these links to falsely check attendees in or out, potentially disrupting event operations and compromising attendee privacy.

Technologies: [HiEventsDev Hi.Events](https://junglewise.ai/threats/technologies/hi-events). Vendors: [HiEventsDev](https://junglewise.ai/threats/vendors/hieventsdev).

## Quick answers

**Is CVE-2026-57960 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57960 being exploited in the wild.

**How severe is CVE-2026-57960?** Medium severity, with a CVSS score of 6.5, published 29 June 2026.

**Which products and versions are affected?** HiEventsDev Hi.Events through 1.9.0.

**Is there a fix for CVE-2026-57960?** A patch was published on 2026-06-27: Pull request submitted to hide attendee email from public resource Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57960 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57960?** Check whether you run HiEventsDev Hi.Events at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Hi.Events through version 1.9.0 utilizes a 'capability-URL' pattern for its public check-in endpoints where a predictable or discoverable 'short_id' serves as the only form of access control. The affected endpoints, specifically /api/public/check-in-lists/{short_id}/attendees, lack the 'auth:api' middleware, allowing unauthenticated GET requests to return paginated attendee PII including email addresses, names, and order IDs. Furthermore, unauthenticated POST and DELETE requests to the check-in endpoints allow for the unauthorized creation or removal of check-in records. While the short_id has high entropy, the vulnerability stems from the lack of secondary authentication (like a PIN or API key) for URLs that are frequently shared with temporary staff or stored in logs. A patch was introduced in June 2024 to remove sensitive fields like email from the public resource.

## Affected products

- HiEventsDev Hi.Events through 1.9.0

## Timeline

- 2026-05-24: disclosed: Vulnerability reported to vendor via email
- 2026-06-17: disclosed: Public GitHub issue opened
- 2026-06-27: patched: Pull request submitted to hide attendee email from public resource
- 2026-06-29: advisory: CVE published and NVD record created

## References

- [https://github.com/HiEventsDev/Hi.Events/issues/1224](https://github.com/HiEventsDev/Hi.Events/issues/1224)
- [https://github.com/HiEventsDev/Hi.Events/pull/1229](https://github.com/HiEventsDev/Hi.Events/pull/1229)
- [https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id](https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id)

## Related threats

- [HiEvents Hi.Events stored XSS via event title in inline scripts](https://junglewise.ai/threats/cve-2026-60119-hievents-hi-events-stored-xss-via-event-title-in-inline-scripts)
- [Hi.Events missing authorization for hidden tickets in order creation](https://junglewise.ai/threats/cve-2026-60118-hi-events-missing-authorization-for-hidden-tickets-in-order)
- [HiEvents Hi.Events promo code usage limit bypass](https://junglewise.ai/threats/cve-2026-57959-hievents-hi-events-promo-code-usage-limit-bypass)