GHSA-92g9-59rr-c3qg: Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Published Oct 27, 2026

Updated

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additionalguests field when guests are disallowed. Attackers can set additionalguests to the remaining seat count in modules/events/eventsfunction.php to exhaust event capacity and block other members from registering.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Admidio to a version that resolves this vulnerability.
Fixed in 5.0.17

Event History

Oct 27, 2026

CVE Published

via OSV·01:07 PM

Data Sourced

via OSV·01:07 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Admidio member can exploit it. The issue affects event registration where guests are disallowed, but the member can still submit the additional_guests field.

What is the practical impact of exploitation?

An attacker can set additional_guests to the remaining number of seats and consume the event's remaining capacity. This can prevent other members from registering for the event.

Which versions should be remediated?

Admidio versions before 5.0.17 are affected. Upgrade to 5.0.17 or later.

GHSA-92g9-59rr-c3qg: Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which versions should be remediated?