Improper Access Control in Admidio Product by Admidio
CVE-2026-117554

5.3MEDIUM

Key Information:

Vendor

Admidio

Status
Admidio
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117554?

Admidio versions prior to 5.0.17 have a vulnerability enabling authenticated members to bypass event guest limitations. By manipulating the additional_guests field, users can effectively exhaust available slots for events, preventing other attendees from registering. This flaw arises from insufficient access control in the events_function.php file, particularly in how guests are tallied for events. To safeguard against this issue, users are advised to upgrade to Admidio version 5.0.17 or later.

Affected Version(s)

admidio 0 < 5.0.17

References

https://github.com/Admidio/admidio/issues/2231
issue-tracking
https://github.com/Admidio/admidio
product
https://github.com/Admidio/admidio/security/advisories/GH...
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gwangwon0807
choewonwoo1817
J0hnathanKim
Kamba-netizen
t-211
xo0102
Fasse
.