CVE-2026-76838

{"id": "CVE-2026-76838", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76838", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T13:54:31.294071Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/HiEventsDev/Hi.Events", "vendor": "HiEventsDev", "product": "Hi.Events", "versions": [{"status": "affected", "version": "0", "lessThan": "1.11.1-beta", "versionType": "semver"}], "packageURL": "pkg:github/HiEventsDev/Hi.Events", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T18:17:22.363", "references": [{"url": "https://github.com/HiEventsDev/Hi.Events", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/HiEventsDev/Hi.Events/blob/v.1.11.0-beta/backend/app/Validators/Rules/NoInternalUrlRule.php", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/HiEventsDev/Hi.Events/commit/cfbf468bb5b1", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/HiEventsDev/Hi.Events/pull/1311", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hi-events-before-beta-server-side-request-forgery-via-unvalidated-webhook-redirects", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and backend/config/webhook-server.php sets no Guzzle options, so redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Both event and organizer webhooks share the rule and the dispatch path. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter."}, {"lang": "es", "value": "Hi.Events valida un destino de webhook solo cuyo se registra, nunca cuyo se usa. NoInternalUrlRule en backend/app/Validators/Rules/NoInternalUrlRule.php resuelve el nombre de host con gethostbyname() y rechaza rangos privados y reservados, lo que cualquier nombre de host p\u00fablico pasa. En el env\u00edo, WebhookDispatchService toma la URL almacenada y la llama a trav\u00e9s de spatie/laravel-webhook-server sin repetir la verificaci\u00f3n, y backend/config/webhook-server.php no establece opciones de Guzzle, por lo que el seguimiento de redirecciones permanece habilitado por defecto. Un destino que responde con una redirecci\u00f3n a una direcci\u00f3n de loopback, privada o de metadatos en la nube, por lo tanto, hace que el servidor emita esa solicitud, y cambiar el registro DNS del nombre de host despu\u00e9s del registro alcanza el mismo resultado porque no se repite ninguna resoluci\u00f3n. La respuesta no se descarta: WebhookResponseHylerService almacena el cuerpo en el registro del webhook y WebhookLogResource lo devuelve desde el endpoint de registros de webhook, por lo que el solicitante lee lo que respondi\u00f3 el servicio interno en lugar de inferirlo. Tanto los webhooks de eventos como los de organizadores comparten la regla y la ruta de env\u00edo. La versi\u00f3n 1.11.1-beta revalida en el env\u00edo, fija la direcci\u00f3n validada, verifica cada salto de redirecci\u00f3n y decodifica direcciones de transici\u00f3n IPv6 que previamente eludieron el filtro."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "disclosure@vulncheck.com"}