CVE-2026-57960
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in Hi.Events up to version 1.9.0 allows unauthorized access to attendee lists via public check-in list endpoints. Using only the short_id, an attacker can retrieve full attendee data including emails and personal information, as well as create or delete check-in records without authentication.
Risk Assessment
The risk involves potential leakage of sensitive personal data of event attendees and compromise of check-in list integrity, which could lead to privacy breaches and reputational damage for the organization.
Recommendation
It is recommended to immediately update Hi.Events to the latest version that fixes this vulnerability. Until the update is applied, restrict access to public check-in list endpoints by implementing authentication and authorization mechanisms.
Other vulnerabilities in Hi.Events
See all- CVE-2026-76838High
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.
- CVE-2026-60119Medium
A cross-site scripting vulnerability in Hi.Events before 1.11.0 allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, which is not escaped by JSON.stringify() when embedded in inline script tags. Attackers can craft an event title that breaks out of the script context in the application/ld+json structured data block or server-side rehydrated state, causing the payload to execute in the browser of any user who views the public event page, including unauthenticated visitors and authenticated administrators.
- CVE-2026-60118Medium
A vulnerability in Hi.Events before version 1.11.0 allows unauthenticated attackers to purchase hidden tickets by referencing their IDs in order creation requests due to missing server-side authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and buy VIP, invite-only, or discounted tickets not intended for public sale.
- CVE-2026-57959Medium
A vulnerability in Hi.Events through version 1.9.0 allows unlimited use of limited promo codes. The validation checks the usage count before the asynchronous UpdateEventStatisticsJob increments it, enabling attackers to sequentially reserve multiple orders with the same code, each seeing usage_count=0, and then complete them all at a discounted price.
Original NVD description (English source)
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.