CVE-2026-76838
Received Received - Intake

Hi.Events Webhook Redirect to Internal Service

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and backend/config/webhook-server.php sets no Guzzle options, so redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Both event and organizer webhooks share the rule and the dispatch path. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-76838
EUVD
EUVD-2026-65010

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
hi_events webhook_dispatch_service 1.11.1-beta
spatie laravel_webhook_server *
hieventsdev hi.events 1.11.0-beta
hieventsdev hi.events to 1.11.1-beta (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Hi.Events where webhook destinations are only validated at registration, not during use. Attackers can register a webhook with a public hostname that later resolves to an internal, private, or cloud metadata address via DNS changes. The stored URL is called without revalidation, and redirects are followed by default, allowing access to sensitive internal services. The response is stored and exposed through webhook logs.

Detection Guidance

To detect this vulnerability, monitor outbound webhook requests from your Hi.Events instance, especially those following redirects to unexpected destinations. Check webhook logs for responses from internal or cloud metadata addresses. Use network tools like tcpdump or Wireshark to inspect traffic from the server running Hi.Events.

Impact Analysis

An attacker could exploit this to access internal services, cloud metadata, or private networks by tricking the server into making requests to restricted addresses. Sensitive data may be exposed through webhook logs, and internal systems could be targeted for further attacks. The impact includes data breaches, unauthorized access, and potential lateral movement within networks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of internal responses via webhook logs may result in data breaches, triggering compliance violations, fines, or legal consequences for failing to protect sensitive information.

Mitigation Strategies

Upgrade to Hi.Events version 1.11.1-beta or later to apply the SSRF fix. If upgrading is not immediately possible, disable webhook redirects in Guzzle settings and manually validate all registered webhook URLs before use. Restrict outbound network access from the Hi.Events server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart