Live › vulnerability › CVE-2026-117554
Go to dashboardAdmidio before 5.0.17 lets an authenticated member register event guests even when guests are disallowed, by sending the additional_guests field. An attacker can set that field to the remaining seat count and block other members from registering for the event.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Sites running Admidio older than that use the events module with registration where guests are disallowed. Any member with a normal login can exploit it. Sites without the events module, or with no logged-in members able to register, can skip it.
5.0.17No product ranges from the sources yet.
5.0.17 or later is fixed).modules/events/events_function.php in the installed code.5.0.17 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
This page as .md · .json · in your agent: get_signal("CVE-2026-117554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.