---
id: CVE-2026-60118
title: Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
summary: >-
  Hi.Events before 1.11.0 contains a missing server-side visibility enforcement
  vulnerability that allows unauthenticated attackers to purchase hidden tickets
  by referencing hidden product and price IDs in order creation requests without
  a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: HiEventsDev
product: Hi.Events
affected:
  - Hi.Events < 1.11.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-15T15:41:47.232739Z'
exploitAvailable: true
published: '2026-07-14'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:31.309Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-60118'
references:
  - url: 'https://github.com/HiEventsDev/Hi.Events/releases/tag/v.1.11.0-beta'
    label: Hi.Events v.1.11.0-beta Release Notes
  - url: >-
      https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2h54-cprv-vj74
    label: GitHub Security Advisory (GHSA-2h54-cprv-vj74)
  - url: 'https://github.com/HiEventsDev/Hi.Events/pull/1259'
    label: Pull Request
  - url: >-
      https://github.com/HiEventsDev/Hi.Events/commit/9eec95e6176f500b71bf633986243045ca78cefb
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/hi-events-beta-hidden-ticket-enumeration-via-order-creation-endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00298
epssPercentile: 0.22606
ingestedAt: '2026-11-08T14:51:22.275Z'
---

## Overview

Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. Attackers can enumerate sequential hidden ticket IDs from visible ones and submit order creation requests referencing those IDs to purchase VIP, invite-only, or discounted tickets intentionally withheld from public sale.

## Affected

- `Hi.Events < 1.11.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.