PT-2026-53678

Hi.Events through 1.9.0 public check-in list endpoints use short id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short id can call GET /api/public/check-in-lists/short id/attendee...