Read the docs
TI-2026-42835 Aliases CVE-2026-60118

Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

Priority HIGH 70CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix Fixed Hi.Events (HiEventsDev): 1.11.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HiEventsDevHi.Eventsbefore 1.11.01.11.0Patch availableCNA
  • Hi.Events VendorHiEventsDev Affected before 1.11.0 Fixed in 1.11.0 Patch available CNA

Remediation

  • Fix · CNA Hi.Events (HiEventsDev) Fixed in 1.11.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HiEventsDev Hi.Events 1.11.0

    2 records Highest priority Priority HIGH 1 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-42836 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify InjectionPriority LOW 23
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-60118

References

Patch 1

Advisory 1

Other 2

  • TI-2026-41726 Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id CVSS 4.0HIGH 8.3
  • TI-2026-53674 Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects CVSS 4.0HIGH 8.4
  • TI-2026-41725 Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition CVSS 4.0HIGH 8.2
  • TI-2026-42836 Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences