CVE-2026-117554: Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.php to exhaust event capacity and block other members from registering.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Admidioto a version that resolves this vulnerability.Fixed in 5.0.17
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Admidio member can exploit it. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What conditions are required for exploitation?
The targeted event must have guest registration disallowed and must still have available seats. The attacker submits the additional_guests field with a value up to the remaining seat count.
What is the practical impact?
An attacker can consume the remaining event capacity with unauthorized guest registrations, preventing other members from registering. The provided scoring indicates integrity impact only, with no stated confidentiality or availability impact.
Which versions are affected?
Admidio versions before 5.0.17 are affected. Upgrading to 5.0.17 or later addresses the stated vulnerable version range.