CVE-2026-57960 describes an access control weakness in Hi.Events through version 1.9.0. The public check-in list API endpoint uses only a short_id as the access control mechanism, which is insufficient to prevent unauthorized access. Attackers with knowledge of this short_id can perform GET requests to /api/public/check-in-lists/{short_id}/attendees to obtain sensitive attendee data including emails and personal information. Additionally, attackers can create or delete check-in records without any authentication. No vendor advisory or patch information is currently provided, and the vulnerability remains unmitigated in affected versions.

Unauthorized actors can access private personal information of event attendees, including emails and other sensitive data, by exploiting the weak access control. They can also manipulate check-in records by creating or deleting them without authentication. This exposure risks privacy violations and potential misuse of attendee data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the short_id values, monitor for suspicious API usage, and consider implementing additional access controls or authentication mechanisms around the affected endpoints.