CVE-2026-30927: Admidio: Event participation IDOR - non-leaders can register other users for events via user_uuid parameter
Vulnerability
In modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter.
Line 47: $getUserUuid = admFuncVariableIsValid($GET, 'useruuid', 'uuid', ...) Line 424: if ($event->possibleToParticipate() || $participants->isLeader($gCurrentUserId))
The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different useruuid and register/cancel participation for that user.
The code then operates on $user->getValue('usrid') (the target user from useruuid) rather than the current user.
Impact - Register unwilling users for events (potential harassment/spam) - Cancel other users' event participation - Manipulate event participant counts and comments - If events have participation limits, fill slots with unwanted registrations
Fix For non-leader users, force useruuid to the current user: php if (!$participants->isLeader($gCurrentUserId)) { $getUserUuid = $gCurrentUser->getValue('usruuid'); }
Other sources
Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/eventsfunction.php, the event participation logic allows any user who can participate in an event to register OTHER users by manipulating the useruuid GET parameter. The condition uses || (OR), meaning if possibleToParticipate() returns true (event is open for participation), ANY user - not just leaders - can specify a different useruuid and register/cancel participation for that user. The code then operates on $user->getValue('usrid') (the target user from useruuid) rather than the current user. This vulnerability is fixed in 5.0.6.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30927?
CVE-2026-30927 has a high severity rating due to an authentication bypass allowing unauthorized event registrations.
How do I fix CVE-2026-30927?
To fix CVE-2026-30927, update Admidio to version 5.0.6 or later to address the vulnerability.
What systems are affected by CVE-2026-30927?
CVE-2026-30927 affects all versions of Admidio prior to 5.0.6.
What is the impact of CVE-2026-30927?
The impact of CVE-2026-30927 allows non-leader users to register other users for events, undermining user permissions.
How can I determine if my Admidio installation is vulnerable to CVE-2026-30927?
You can determine vulnerability by checking if your Admidio version is below 5.0.6.