Vulnerability Description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Admidio/admidio
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.p
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44
- https://github.com/Admidio/admidio/issues/2231
- https://github.com/Admidio/admidio/releases/tag/v5.0.17
- https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg
- https://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restricti
FAQ
What is CVE-2026-117554?
CVE-2026-117554 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed....
How severe is CVE-2026-117554?
CVE-2026-117554 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-117554?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.