Threat Intelligence Database

Hi.Events versions up to and including 1.9.0 expose private personal information through public check-in list endpoints that rely solely on a short_id for access control. This allows unauthenticated attackers who know the short_id to retrieve full attendee lists with emails and personal data, and to create or delete check-in records without authentication. The vulnerability has a high severity score of 8.3 CVSS 4.0. No official patch or remediation guidance is currently available.

Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequentially reserve multiple orders with the same restricted promo code, each reading order_usage_count=0 and passing validation, then complete them all at discounted prices without concurrent requests.