CVE-2026-117554 in Admidio
Summary
by MITRE • 10/27/2026
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability resides within Admidio, a widely used open-source community management software, specifically affecting versions prior to 5.0.17. This flaw is classified as an improper access control issue that permits authenticated users to bypass intended security restrictions regarding event registration limits. The core of the problem lies in how the application handles input validation for guest registrations within its event module. Specifically, when administrators have configured events such that guests are not allowed or are restricted by capacity, the system fails to properly validate whether a user is authorized to add additional attendees beyond their own presence. This lack of robust server-side enforcement allows an authenticated member to manipulate the registration process through direct parameter manipulation.
Technically, the vulnerability exploits the handling of the additional_guests field in the file modules/events/events_function.php. When a user attempts to register for an event, they can submit this specific HTTP request parameter with arbitrary values. By setting the value of additional_guests to match or exceed the remaining seat count available for the event, an attacker can artificially inflate the number of registered attendees. The application logic accepts these inputs without sufficiently verifying if the action aligns with the configured access policies that prohibit guest registrations in certain contexts. This allows the user to register more participants than physically or logically permitted by the event settings, effectively bypassing the capacity constraints designed to manage attendance limits.
The operational impact of this vulnerability is primarily centered around denial of service and resource exhaustion within the context of specific events. By exploiting this flaw, an attacker can exhaust all available seats for a particular event, thereby preventing legitimate members from registering. This creates a situation where valid users are blocked from participating in activities they have paid for or been invited to attend. In environments where Admidio is used for managing critical community resources such as workshops, meetings, or social gatherings, this disruption can lead to significant logistical issues and dissatisfaction among the user base. Furthermore, while the primary impact described is availability-related, the ability to manipulate registration data could potentially be leveraged in more complex attack chains if combined with other vulnerabilities, though the immediate risk remains focused on disrupting service for legitimate users.
From a classification perspective, this vulnerability aligns with CWE-284, which describes Improper Access Control, as it involves an actor bypassing intended restrictions to perform actions not authorized by the system configuration. It also relates to CWE-770, Allocation of Resources Without Limits or Throttling, because the attacker can consume all available resources (event seats) without proper limits being enforced during the registration process. In terms of threat modeling and ATT&CK framework mapping, this behavior corresponds to T1496, Resource Hijacking, where an adversary uses a compromised account to exhaust system resources, thereby impacting availability for other users. It also touches upon aspects of T1078, Valid Accounts, as the exploitation requires prior authentication, highlighting that even legitimate credentials can be misused when access controls are insufficiently granular or enforced incorrectly.
To mitigate this vulnerability, organizations running Admidio must immediately upgrade to version 5.0.17 or later, where these input validation checks have been corrected. Until an update is applied, administrators should consider implementing network-level restrictions if possible, although application-layer fixes are the primary solution. It is also advisable to review event configurations and ensure that sensitive operations involving guest registration are monitored for anomalous patterns of seat consumption. Regular security audits focusing on access control logic in community management platforms can help identify similar flaws before they are exploited. Maintaining up-to-date software versions remains the most effective defense against such misconfigurations and implementation errors inherent in older releases.