EUVD-2026-43740Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable unauthenticated API endpoint with no interaction required; impact is low integrity only - unauthorized ticket purchase with no data disclosure or service disruption.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hi.Events through v1.10.0-beta contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.
AnalysisAI
Hidden ticket purchase bypass in Hi.Events through v1.10.0-beta allows unauthenticated remote attackers to acquire VIP, invite-only, or discounted tickets withheld from public sale by referencing hidden ticket and price IDs directly in order creation API requests. The server fails to enforce ticket visibility rules at the API layer, relying only on UI-level concealment, and sequential integer ticket IDs allow systematic enumeration from observed visible IDs. No public exploit or active exploitation (KEV) has been identified at time of analysis, but the unauthenticated network vector and low complexity make opportunistic exploitation straightforward following disclosure.
Technical ContextAI
Hi.Events is an open-source event management and ticketing platform (CPE: cpe:2.3:a:hieventsdev:hi.events:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): the order creation endpoint accepts ticket and price IDs supplied by the client without validating whether those tickets are marked visible or purchasable by the requesting party. Ticket visibility is enforced only client-side by hiding hidden-ticket IDs from the public checkout UI, but the underlying IDs appear to be sequential integers - a well-known insecure direct object reference (IDOR) pattern. An attacker observing visible ticket IDs can increment or decrement those values to enumerate hidden ticket IDs, then POST crafted order creation requests referencing them. The fix was introduced in PR #1259 (commit 9eec95e6176f500b71bf633986243045ca78cefb) and released in v1.11.0-beta.
RemediationAI
Upgrade Hi.Events to v1.11.0-beta or later, which patches hidden ticket purchase prevention via PR #1259 (commit 9eec95e6176f500b71bf633986243045ca78cefb). The vendor advisory is at https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2h54-cprv-vj74 and the patched release at https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta. As a pre-patch compensating control, operators can temporarily convert hidden tickets to unpublished or deleted status so no hidden IDs exist in the system to be referenced - trade-off is loss of hidden-ticket functionality until the upgrade is applied. Additionally, implementing rate-limiting on the order creation endpoint and alerting on order requests referencing ticket IDs not present in the public-facing catalog can help detect exploitation attempts in progress.
SQL injection in Hi.Events open-source event management platform (versions 0.8.0-beta.1 through 1.7.0-beta) allows remot
Server-side request forgery in Hi.Events (all versions prior to 1.11.1-beta) allows an authenticated platform user to ex
Stored cross-site scripting in Hi.Events through v1.10.0-beta allows authenticated event organizers to inject arbitrary
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today