CVE-2026-60118 json
Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
published 2026-07-14 3 mo ago modified 2026-11-08 27 h ago also EUVD-2026-43740
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
Patch / fix
- HiEventsDev Hi.Events 1.11.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2h54-cprv-vj74 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- HiEventsDev Hi.Events
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/HiEventsDev/Hi.Events/pull/1259
issue-tracking, patch
-
github.com
/HiEventsDev/Hi.Events/commit/9eec95e6176f500b71bf633986243045ca78cefb
patch
-
github.com
/HiEventsDev/Hi.Events/security/advisories/GHSA-2h54-cprv-vj74
vendor-advisory, exploit
-
github.com
/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta
release-notes
-
vulncheck.com
/advisories/hi-events-beta-hidden-ticket-enumeration-via-order-creation-endpoint
third-party-advisory
Sources
- CVE List CVE-2026-60118
- NVD CVE-2026-60118
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.