CVE-2026-60118: Hi.Events Auth Bypass Vulnerability

CVE-2026-60118 Overview

CVE-2026-60118 affects Hi.Events versions before 1.11.0. The vulnerability stems from missing server-side visibility enforcement on the order creation endpoint. Unauthenticated attackers can purchase hidden tickets by referencing hidden product and price IDs in order creation requests. Because the endpoint does not verify whether the referenced tickets are marked as hidden, attackers bypass intended access restrictions. Attackers enumerate sequential hidden ticket IDs from visible ones, then submit crafted order creation requests. This allows purchase of VIP, invite-only, or discounted tickets intentionally withheld from public sale. The issue is classified under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated attackers can enumerate and purchase hidden VIP, invite-only, or discounted tickets by submitting order creation requests with predictable sequential product and price IDs.

Affected Products

Hi.Events versions prior to 1.11.0
Hi.Events order creation endpoint (public-facing)
Deployments exposing hidden ticket products and prices

Discovery Timeline

2026-07-14 - CVE-2026-60118 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-60118

Vulnerability Analysis

Hi.Events supports hidden tickets for VIP, invite-only, and discounted sales flows. These tickets are intended to remain outside public listings and require explicit distribution of a link or code. The vulnerability breaks that model. The order creation endpoint accepts product and price identifiers from the client and processes the order without confirming whether the referenced items are marked hidden. This is a business logic flaw combined with broken access control. The [CWE-862] classification reflects the absence of an authorization check on a sensitive operation. Because ticket identifiers are sequential integers, an attacker who observes any visible ticket ID can iterate adjacent values to reach hidden ones. The EPSS probability sits at 0.235%, but the low complexity and network-reachable nature of the endpoint make targeted abuse straightforward.

Root Cause

The server trusts client-supplied product and price IDs during order creation. It does not filter out items whose visibility flag is set to hidden. The fix introduced in Hi.Events 1.11.0 adds server-side visibility enforcement before an order is accepted. See the GitHub Pull Request #1259 and GitHub Commit Details for the code changes.

Attack Vector

An unauthenticated attacker first browses a public event page and records the numeric identifiers assigned to visible tickets. The attacker then enumerates adjacent integer IDs and issues order creation requests that reference each candidate product and price ID. When a hidden ticket ID is referenced, the server processes the order and issues the ticket at whatever price the hidden record specifies. No credentials, tokens, or invite links are required. Further technical detail is available in the VulnCheck Advisory on Hi.Events and the GitHub Security Advisory GHSA-2h54-cprv-vj74.

No verified proof-of-concept code is available. The exploitation pattern involves standard HTTP POST requests to the order creation endpoint with iterated numeric identifiers in the request body.

Detection Methods for CVE-2026-60118

Indicators of Compromise

Order records that reference product or price IDs flagged as hidden in the event configuration.
Sequential enumeration patterns in web server logs targeting the order creation endpoint.
Successful ticket issuance for VIP, invite-only, or discount SKUs without a corresponding invite link click or code redemption event.

Detection Strategies

Compare completed orders against the current hidden-ticket inventory and flag any matches that did not originate from an authorized distribution channel.
Alert on repeated POST requests to the order creation endpoint from a single source that iterate product or price identifiers within short time windows.
Correlate anonymous order submissions with the referrer chain to identify orders that bypassed the public ticket listing page.

Monitoring Recommendations

Enable verbose application logging on the order creation endpoint, capturing referenced product IDs, price IDs, source IP, and user agent.
Rate-limit unauthenticated order creation requests per IP to slow enumeration.
Review historical order data for hidden-ticket purchases dating back to the deployment of any Hi.Events version below 1.11.0.

How to Mitigate CVE-2026-60118

Immediate Actions Required

Upgrade Hi.Events to version 1.11.0 or later, which enforces server-side visibility checks during order creation.
Audit all completed orders for hidden-ticket references and revoke any tickets issued outside authorized channels.
Rotate hidden ticket IDs where feasible and reissue authorized invite links after upgrading.

Patch Information

The fix is included in Hi.Events 1.11.0. Refer to the GitHub Release v1.11.0-beta notes and the corresponding GitHub Commit Details for the code change that adds authorization checks on hidden products and prices.

Workarounds

Restrict access to the order creation endpoint behind a reverse proxy rule that requires a valid invite token as a query parameter until the patch is applied.
Temporarily disable hidden-ticket product configurations and manage VIP or invite-only sales through an out-of-band channel.
Deploy a Web Application Firewall rule that blocks order creation requests whose referenced product IDs do not appear in the public event listing response.

bash

# Upgrade Hi.Events to the patched release
git fetch --tags
git checkout v.1.11.0-beta
# Rebuild and restart the application
docker compose build --no-cache
docker compose up -d