CVE-2026-57960 affects Hi.Events through version 1.9.0, where the public check-in list API endpoints use the short_id as the only access control mechanism. This design flaw permits unauthenticated attackers who can guess or obtain a valid short_id to access sensitive attendee information, including emails and personal details. Additionally, attackers can manipulate check-in records by creating or deleting them via the same unauthenticated API calls. The vulnerability is rated high severity with a CVSS 4.0 score of 8.3, reflecting network attack vector, high complexity, no privileges or user interaction required, but with high confidentiality impact and low integrity impact. There is no vendor advisory or patch currently available, and the product is not a cloud service, so remediation depends on vendor action or user mitigation.

Unauthorized actors can access full attendee lists containing private personal information such as emails without authentication. They can also create or delete check-in records, potentially disrupting event attendance data integrity. This exposure compromises confidentiality and partially affects data integrity. The vulnerability does not require privileges or user interaction, increasing the risk of exploitation if short_ids are discovered.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the API endpoints by implementing additional authentication or access controls around the check-in list endpoints. Monitor for unauthorized access attempts and consider rotating or invalidating existing short_ids if possible.