CVE-2026-60118mediumCWE-862

CVE-2026-60118: medium-severity vulnerability in HiEventsDev Hi.Events

Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

Published · Updated

Follow this CVE+ Monitor Hi.Events

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.3%
Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
HiEventsDev · Hi.Events
Related CVEs — HiEventsDev Hi.Events

In the same product, most dangerous first.

CVE-2026-76838HIGHHi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook RedirectsEPSS 0.4%CVE-2026-57960HIGHHi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_idEPSS 0.4%CVE-2026-34455HIGHHi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository ClassesEPSS 0.4%CVE-2026-60119MEDIUMHi.Events < 1.11.0 XSS via Event Title JSON.stringify InjectionEPSS 0.3%CVE-2026-57959HIGHHi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race ConditionEPSS 0.3%