PT-2026-58093

CVE-2026-60118

Published

2026-07-14

Updated

2026-07-14

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.11.0

Description Missing server-side visibility enforcement allows unauthenticated attackers to purchase hidden tickets. By referencing hidden product and price IDs in order creation requests, attackers can bypass authorization checks. This is possible by enumerating sequential hidden ticket IDs based on visible ones to acquire VIP, invite-only, or discounted tickets that were intentionally withheld from public sale.

Recommendations Update Hi.Events to version 1.11.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adam Młynarczyk

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers