CVE-2026-117554GHSA-92g9-59rr-c3qg
Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
admidio admidio
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.0.17admidioCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
Text from CVE List
Affected versions 1
- admidioaffected: all versions before 5.0.17CVE List
References 7
- github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9Fixvia CVE List
- github.com/Admidio/admidio/releases/tag/v5.0.17Fixvia CVE List
- github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qgAdvisoryvia CVE List
- vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-via-events-function-phpAdvisoryvia CVE List
- github.com/Admidio/admidio/issues/2231Referencevia CVE List
- github.com/Admidio/admidioReferencevia CVE List
- github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462Referencevia CVE List