CVE-2026-60118

Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.

Analysis

AI-generated

Technical impact

Hi.Events versions before 1.11.0 omit server‑side visibility checks, letting an attacker send order creation requests that reference hidden product and price identifiers. Because no authentication or authorization is performed, the attacker can buy tickets that are meant to remain private, such as VIP, invite‑only, or heavily discounted items, leading to revenue loss and potential misuse of premium access. The flaw maps to Missing Authorization (CWE‑862).

Affected Systems

The vulnerability affects all instances of Hi.Events deployed with a version older than 1.11.0, including the beta and release candidates preceding that milestone. The issue is active against the order creation API endpoint exposed by the Hi.Events application.

Risk and Exploitability

The CVSS score of 6.9 grades the issue as moderate, while the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation at the present moment. The flaw is not listed in the CISA KEV catalog. Attackers would exploit the defect by sending crafted POST requests to the order creation endpoint without needing any credentials; enumeration of sequential hidden ticket IDs is trivial once a valid hidden ID is discovered.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Hi.Events application to version 1.11.0 or later, which implements proper server‑side visibility enforcement on the order creation endpoint.
  • If an upgrade is not immediately possible, enforce authentication or API‑key validation on the order creation endpoint so that only authorized requests can reference hidden product identifiers.
  • As a temporary measure, implement network‑level restrictions or rate limiting on the order creation API to avoid automated enumeration attempts.

Generated by OpenCVE AI on July 31, 2026 at 10:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Hi.events
Hi.events hi.events
CPEs cpe:2.3:a:hi.events:hi.events:*:*:*:*:*:*:*:*
Vendors & Products Hi.events
Hi.events hi.events
Type Values Removed Values Added
Description Hi.Events through v1.10.0-beta contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale. Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
Title Hi.Events v1.10.0-beta Hidden Ticket Enumeration via Order Creation Endpoint Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
Type Values Removed Values Added
First Time appeared Hieventsdev
Hieventsdev hi.events
Vendors & Products Hieventsdev
Hieventsdev hi.events
Type Values Removed Values Added
Description Hi.Events through v1.10.0-beta contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
Title Hi.Events v1.10.0-beta Hidden Ticket Enumeration via Order Creation Endpoint
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Nov 8, 2026, 2:07 PM
Reserved
Jul 8, 2026, 1:27 PM

View source JSON

Updated
Jul 15, 2026, 3:42 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 4:17 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 10:15 AM

JSON