TI-2026-81158 Aliases CVE-2026-117554 GHSA-9v6c-vxr5-xp32

Event guest restriction bypass in Admidio event registration

MEDIUM 57CWE-602Published 2026-10-27 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Admidio before 5.0.17 contains an improper access control flaw that lets authenticated members register event guests by submitting the additional_guests field when guests are disallowed. The server does not enforce the guest restriction, a weakness classified as CWE-602. An authenticated member with low privileges can set additional_guests to the remaining seat count in modules/events/events_function.php, filling event capacity and blocking other members from registering.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00289 21st percentileScored 2026-11-07

Fix Fixed admidio (admidio): 5.0.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Admidio	admidio	before 5.0.17	5.0.17	Patch available	CNA

admidio VendorAdmidio Affected before 5.0.17 Fixed in 5.0.17 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:admidio:admidio::::::::	—	—	Admidio

cpe:2.3:a:admidio:admidio:*:*:*:*:*:*:*:* Versions — — ·Admidio

Remediation

Update Admidio to version 5.0.17, which fixes the issue. The sources list no fixed version for any other product.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA admidio (admidio) Fixed in 5.0.17

Timeline

2026-10-27 Threatist record created from CVE-2026-117554
2026-10-27 Alias added: GHSA-9v6c-vxr5-xp32
2026-11-02 CISA SSVC decision points changed
2026-11-02 Priority changed: LOW → MEDIUM

References

Patch 1

https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9

Advisory 1

GitHub Security Advisory (GHSA-92g9-59rr-c3qg)

Other 4

TI-2026-25286 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion CVSS 3.1CRITICAL 9.1
TI-2026-56995 Admidio before 5.0.12 Authentication Bypass via RSS feeds CVSS 4.0HIGH 8.7
TI-2026-56993 Admidio before 5.0.12 SQL Injection via relation_type_list CVSS 4.0HIGH 8.7
TI-2024-25222 Admidio has Blind SQL Injection in ecard_send.php CVSS 3.1CRITICAL 10.0
TI-2026-30186 Admidio: SAML Signature Validation Result Ignored — Forged AuthnRequests and LogoutRequests Processed CVSS 3.1HIGH 8.2
TI-2024-25764 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment CVSS 3.1CRITICAL 9.1

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences