CVE-2026-117554
mediumAdmidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional…
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Admidio/admidio disclosure@vulncheck.com
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L4... disclosure@vulncheck.com
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9 disclosure@vulncheck.com
- https://github.com/Admidio/admidio/issues/2231 disclosure@vulncheck.com
- https://github.com/Admidio/admidio/releases/tag/v5.0.17 disclosure@vulncheck.com
- https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-... disclosure@vulncheck.com