CVE-2026-57960: Hi.Events Auth Bypass Vulnerability

CVE-2026-57960 Overview

CVE-2026-57960 is an access control vulnerability in Hi.Events through version 1.9.0. Public check-in list endpoints rely on the short_id parameter as the sole authorization mechanism. Any attacker who obtains or guesses a valid short_id can retrieve full attendee lists containing names, email addresses, and personal information without authentication. The same endpoints permit unauthenticated creation and deletion of check-in records. The flaw is categorized under [CWE-359: Exposure of Private Personal Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can enumerate short_id values against the public API and exfiltrate attendee personally identifiable information (PII) while manipulating check-in state for any event.

Affected Products

Hi.Events versions up to and including 1.9.0
The /api/public/check-in-lists/{short_id}/attendees endpoint
Self-hosted and cloud deployments of Hi.Events prior to the fix in Pull Request #1229

Discovery Timeline

2026-06-29 - CVE-2026-57960 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-57960

Vulnerability Analysis

Hi.Events is an open-source event management platform that exposes public endpoints for event check-in workflows. The application treats the short_id value embedded in check-in list URLs as a shared secret capable of authorizing arbitrary API operations. No session token, API key, or user role check gates the /api/public/check-in-lists/{short_id}/attendees endpoint. An attacker who knows the identifier can issue GET requests to retrieve attendee records and issue write requests to create or delete check-in entries. The confidentiality impact is high because attendee records contain names, emails, and event metadata suitable for phishing and doxxing campaigns.

Root Cause

The root cause is reliance on an opaque but non-secret URL path parameter for access control. short_id values are not treated as capabilities under strict entropy or lifecycle management. They are shared with staff, printed on materials, and often reused, which makes disclosure and enumeration realistic. The application also fails to require authentication for state-changing operations on check-in records, extending the same trust boundary to write actions.

Attack Vector

An unauthenticated remote attacker sends GET /api/public/check-in-lists/{short_id}/attendees to retrieve attendee data. The attacker can then invoke corresponding create or delete operations against check-in records using the same short_id. Attackers obtain valid identifiers through URL leakage in shared links, screenshots, staff communications, or brute-force enumeration where entropy is insufficient. See the VulnCheck Security Advisory and GitHub Issue #1224 for technical details.

Detection Methods for CVE-2026-57960

Indicators of Compromise

Unauthenticated HTTP requests to /api/public/check-in-lists/*/attendees from unfamiliar source IPs or user agents
Bursts of GET requests iterating across differing short_id values, indicative of enumeration
Unexpected check-in record creation or deletion events with no corresponding staff session
Outbound egress of attendee data volumes disproportionate to normal event traffic

Detection Strategies

Review web server and application access logs for high-frequency requests against the check-in-lists path
Correlate check-in state changes with authenticated staff sessions to identify anonymous mutations
Alert on repeated 200 responses to check-in-lists/{short_id}/attendees from a single IP within short windows

Monitoring Recommendations

Enable request logging on the Hi.Events API gateway or reverse proxy for all /api/public/* routes
Deploy rate limits and anomaly detection on public check-in endpoints
Track database audit logs for attendee read volume and check-in record deletions

How to Mitigate CVE-2026-57960

Immediate Actions Required

Upgrade Hi.Events to the patched release containing the fix from Pull Request #1229
Rotate all existing short_id values so previously leaked identifiers cannot be reused
Restrict access to /api/public/check-in-lists/* behind an authenticated reverse proxy until the upgrade completes
Audit recent access logs for unauthenticated retrieval of attendee data and notify affected attendees if exposure is confirmed

Patch Information

The upstream fix is tracked in GitHub Pull Request #1229, which introduces authentication and authorization checks on the check-in list endpoints. Administrators running Hi.Events 1.9.0 or earlier should update to a release that incorporates this pull request. Additional context is available in GitHub Issue #1224.

Workarounds

Place the Hi.Events API behind a reverse proxy that requires authentication for the /api/public/check-in-lists/ path
Apply IP allowlisting on check-in endpoints so only trusted venue networks can reach them
Enforce strict rate limiting on public endpoints to slow short_id enumeration
Disable public check-in workflows until the patch is deployed if attendee data sensitivity warrants it

bash

# Example nginx configuration restricting public check-in endpoints
location ~ ^/api/public/check-in-lists/ {
    allow 203.0.113.0/24;   # Trusted venue network
    deny all;
    limit_req zone=checkin burst=10 nodelay;
    proxy_pass http://hi_events_upstream;
}