Which versions of PostgreSQL are affected by CVE-2026-34455?

Hi.Events event management platform versions 0.8.0-beta.1 through 1.7.0-beta contain an unauthenticated SQL injection vulnerability that allows remote attackers to extract, modify, or delete database…. A patch is available.

How to fix or mitigate CVE-2026-34455?

Within 24 hours: Identify all systems running Hi.Events versions 0.8.0-beta.1 through 1.7.0-beta and isolate from production if feasible. Within 7 days: Apply vendor patch to version 1.7.1-beta or later on all affected instances and validate deployment. Within 30 days: Conduct forensic review of database access logs for any suspicious SQL queries or unauthorized data access during the exposure window.

PostgreSQL CVE-2026-34455

Q: What is the CVSS score of CVE-2026-34455?

CVE-2026-34455 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18007 HIGH

SQL Injection (CWE-89)

2026-04-01 security-advisories@github.com

SQLi PostgreSQL

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:09 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.7.1-beta

EUVD ID Assigned

Apr 01, 2026 - 20:27 euvd

EUVD-2026-18007

Analysis Generated

Apr 01, 2026 - 20:27 vuln.today

CVE Published

Apr 01, 2026 - 20:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. This issue has been patched in version 1.7.1-beta.

AnalysisAI

SQL injection in Hi.Events open-source event management platform (versions 0.8.0-beta.1 through 1.7.0-beta) allows remote unauthenticated attackers to execute arbitrary SQL queries via unsanitized sort_by parameters passed to Eloquent's orderBy() method. The PostgreSQL backend supports stacked queries, enabling multi-statement injection. While CVSS 8.7 reflects high confidentiality impact and no authentication requirement, no public exploit code or CISA KEV listing exists at time of analysis. Vendor-released patch available in version 1.7.1-beta.

Technical ContextAI

Hi.Events uses Laravel's Eloquent ORM with PostgreSQL as the database backend. The vulnerability stems from CWE-89 (SQL Injection) where multiple repository classes accept user-controlled sort_by query parameters from HTTP requests and pass them directly to Eloquent's orderBy() method without input validation or parameterization. Unlike MySQL's default configuration, PostgreSQL allows stacked queries (semicolon-separated statements), which escalates the impact from data exfiltration to potential command chaining. The flaw exists in the event management and ticketing workflow components where sorting functionality is exposed to unauthenticated users through the web interface. The commit reference (01e1aee28d7) indicates the fix implements input validation against a whitelist of allowed column names before passing values to the ORM layer.

RemediationAI

Upgrade to Hi.Events version 1.7.1-beta immediately, available at https://github.com/HiEventsDev/Hi.Events/releases/tag/v1.7.1-beta. The upstream fix in commit 01e1aee28d7 and pull request 1128 (https://github.com/HiEventsDev/Hi.Events/pull/1128) implements input validation for sort_by parameters against an allowed column whitelist before passing to Eloquent orderBy(). Organizations unable to upgrade immediately should implement web application firewall (WAF) rules to block requests containing SQL metacharacters (semicolons, quotes, comment sequences) in sort_by and similar sorting parameters. Network-level access controls restricting Hi.Events administrative interfaces to trusted IP ranges provide defense-in-depth. Review PostgreSQL logs for suspicious multi-statement queries or unexpected ORDER BY clauses as indicators of exploitation attempts. Audit any custom repository classes for similar unvalidated user input passed to ORM methods.