CVE-2026-60118CWE-862

Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

Medium · published July 14, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-14T15:42Z
EPSS history
Timeline
  • 14 JUL 15:42Z
    Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
    cvelistv5