Description
Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HiEventsDev | Hi.Events | ≤ 1.9.0 | — |
References
- Researcher Disclosure issue-tracking
- Pull Request issue-tracking patch
- https://www.vulncheck.com/advisories/hi-events-unauthenticated-attendee-pii-exposure-via-check-in-list-short-id third-party-advisory