Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-117554Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
Medium 4.3
In plain English
A medium-severity security flaw in admidio from admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 78.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
Affected products (as reported)
Weakness: CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Issue #2231 issue-tracking
- https://github.com/Admidio/admidio product
- GitHub Security Advisory (GHSA-92g9-59rr-c3qg) vendor-advisory
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9 patch
- admidio v5.0.17 Release Notes release-notes
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462 technical-description
- VulnCheck Advisory: Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php third-party-advisory