CVE-2026-57960
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jun 29, 2026
CISA due date
—
The record
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
- CVE-2026-48048 XWiki Platform is a generic wiki platform. CWE-359
- CVE-2026-24078 Information Disclosure when IPSec negotiation fails or is not established properly during… CWE-359
- CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
- CVE-2026-50657 Exposure of private personal information to an unauthorized actor in Microsoft Defender… CWE-359