CVE-2026-57960: fallo de gravedad alta en HiEventsDev Hi.Events
Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.3epss 0.4%
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
HiEventsDev · Hi.EventsCVEs relacionadas — HiEventsDev Hi.Events
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-76838HIGHHi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook RedirectsEPSS 0.4%CVE-2026-34455HIGHHi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository ClassesEPSS 0.4%CVE-2026-60119MEDIUMHi.Events < 1.11.0 XSS via Event Title JSON.stringify InjectionEPSS 0.3%CVE-2026-60118MEDIUMHi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation EndpointEPSS 0.3%CVE-2026-57959HIGHHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race ConditionEPSS 0.3%