MEDIUM 5.3 NVD
CVE-2026-117554
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
References
- https://github.com/Admidio/admidio
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L4
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9
- https://github.com/Admidio/admidio/issues/2231
- https://github.com/Admidio/admidio/releases/tag/v5.0.17
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18943 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.