Auth bypass in Hieventsdev Hi.events
CVE-2026-60118
Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
Vulnerability class: Broken Access Control
EPSS: 0.004 (33.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Hieventsdev Hi.events — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-60118?
- CVE-2026-60118 is a medium-severity vulnerability in Hieventsdev Hi.events, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-07-14.
- How severe is CVE-2026-60118?
- Medium severity. CVSS v3 base score is 5.3 out of 10.