CVE-2026-76838

Name of the Vulnerable Software and Affected Versions Hi.Events versions prior to 1.11.1-beta

Description An issue exists where webhook destinations are validated only during registration and not during use. The NoInternalUrlRule function in backend/app/Validators/Rules/NoInternalUrlRule.php uses gethostbyname() to reject private and reserved IP ranges, but public hostnames are permitted. During dispatch, the WebhookDispatchService utilizes the stored URL via spatie/laravel-webhook-server without re-validating the destination. Because backend/config/webhook-server.php does not configure Guzzle options, redirect following is enabled by default. This allows a destination to redirect the server to a loopback, private, or cloud metadata address, or allows an attacker to change a DNS record after registration to achieve the same result. The WebhookResponseHandlerService stores the response body in the webhook log, which is then exposed via the WebhookLogResource endpoint, allowing the requester to read responses from internal services. This affects both event and organizer webhooks.

Recommendations Update Hi.Events to version 1.11.1-beta.