Senti-Man

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.1-beta **Description** An issue exists where webhook destinations are validated only during registration and not during use. The `NoInternalUrlRule` function in `backend/app/Validators/Rules/NoInternalUrlRule.php` uses `gethostbyname()` to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the `WebhookDispatchService` utilizes the stored URL via `spatie/laravel-webhook-server` without re-validating the destination. Because `backend/config/webhook-server.php` does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The `WebhookResponseHandlerService` stores the response body in the webhook log, which is then exposed via the `WebhookLogResource` endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks. **Recommendations** Update Hi.Events to version 1.11.1-beta.