Hi.Events Missing Authorization for Hidden Ticket Purchase

Executive Summary

CVE-2026-60118 is a missing server-side visibility enforcement vulnerability in Hi.Events through version 1.10.0-beta. It allows unauthenticated attackers to purchase hidden tickets by exploiting the order creation process.

The vulnerability occurs because the application does not properly validate whether a ticket is hidden before allowing its purchase. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs. This bypasses restrictions intended to keep certain tickets (such as VIP, invite-only, or discounted tickets) hidden from public sale.

The issue stems from improper access control, where the backend accepts manipulated requests containing hidden ticket IDs without verifying their visibility status. This flaw is classified under CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization).

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking if hidden tickets or products can be purchased through the public checkout process by referencing their IDs. Since the vulnerability allows attackers to enumerate sequential hidden ticket IDs from visible ones, you can attempt to simulate this behavior to verify if your system is affected.

• Intercept and analyze checkout requests: Use a proxy tool like Burp Suite or OWASP ZAP to intercept and inspect HTTP requests sent to the order creation endpoint. Look for requests that include product or price IDs that are not publicly visible.
• Test with sequential IDs: If visible ticket IDs are sequential (e.g., 1, 2, 3), try submitting order creation requests with adjacent IDs (e.g., 4, 5, 6) to see if hidden tickets can be purchased. For example, if the last visible ticket ID is 10, attempt to purchase ticket ID 11 or 9.
• Check server responses: If the server accepts the request and processes the order for a hidden ticket, the vulnerability is present. A vulnerable system will return a success response instead of rejecting the request.
• Review logs: Examine server logs for order creation requests that include product or price IDs not listed on public event pages. Look for patterns where hidden IDs are being referenced.

Example command to test for the vulnerability (using curl):

• curl -X POST https://your-hievents-instance.com/api/orders -H "Content-Type: application/json" -d '{"product_id": 11, "price_id": 1, "quantity": 1}'

Replace the product_id and price_id with values that are not publicly visible. If the request succeeds, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you are an event organizer using Hi.Events, this vulnerability could allow unauthorized individuals to purchase restricted tickets that were meant to be hidden or limited to specific audiences.

• Attackers could buy VIP, invite-only, or discounted tickets that were not intended for public sale, potentially leading to financial losses or overcrowding of exclusive events.
• The vulnerability could be exploited to bypass promotional or access controls, allowing attackers to obtain tickets at lower prices or without proper authorization.
• If hidden tickets are part of a limited or controlled release, attackers could deplete the available stock, preventing legitimate users from purchasing them.

For end-users or attendees, this vulnerability does not directly impact personal data or system access, but it could lead to unfair advantages for attackers in obtaining restricted tickets.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily involves improper access control and unauthorized purchases of restricted tickets. Its impact on compliance with common standards and regulations depends on the context of the data or systems involved.

• GDPR: The vulnerability does not directly involve the processing or exposure of personal data, so it is unlikely to violate GDPR requirements. However, if hidden tickets are tied to personal data (e.g., invite-only events with attendee lists), unauthorized access could indirectly lead to compliance risks if personal data is mishandled or exposed.
• HIPAA: This vulnerability is unrelated to protected health information (PHI) or healthcare systems, so it does not impact HIPAA compliance.
• PCI DSS: If the vulnerability allows attackers to bypass payment controls or manipulate pricing, it could indirectly affect PCI DSS compliance by undermining the security of payment card data. However, the vulnerability itself does not directly expose payment card information.
• ISO 27001: The vulnerability represents a failure in access control (A.9) and system acquisition/development (A.14), which are key components of ISO 27001. Organizations using Hi.Events may need to address this vulnerability to maintain compliance with these controls.

While the vulnerability may not directly violate specific regulations like GDPR or HIPAA, it could still pose risks to organizational security policies and industry best practices. Organizations should assess the broader implications of the vulnerability on their compliance posture.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps to prevent unauthorized purchases of hidden tickets or products.

• Upgrade to the latest version: Apply the patch by upgrading to Hi.Events v1.11.0-beta or later, which includes fixes for this vulnerability. The patch ensures that hidden products and price tiers are rejected during public order creation.
• Apply the patch manually: If upgrading is not immediately possible, apply the fix from the GitHub commit (9eec95e617f500b71bf633986243045ca78cefb) or Pull Request #1259. This involves adding server-side validation to check if a product or price tier is hidden before allowing a purchase.
• Implement access controls: Ensure that the order creation endpoint validates whether a product or price tier is hidden. If it is hidden, the request should be rejected unless a valid promo code is provided.
• Avoid sequential IDs: If possible, replace sequential product or ticket IDs with non-guessable identifiers (e.g., UUIDs) to make enumeration more difficult for attackers.
• Monitor for suspicious activity: Review logs for order creation requests that include hidden product or price IDs. Set up alerts for repeated failed attempts to purchase hidden tickets, as this may indicate an attack.
• Temporarily disable hidden tickets: If the patch cannot be applied immediately, consider temporarily making all tickets visible or disabling the purchase of hidden tickets until the fix is in place.

Useful 0 Not Useful 0