CVE-2026-117554 Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117554?
CVE-2026-117554 is a medium-severity vulnerability in admidio, published on 27 Oct 2026.
Official description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
Weakness: CWE-602
Which versions are affected by CVE-2026-117554?
How do I fix CVE-2026-117554?
No fix has been published for CVE-2026-117554 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117554 being exploited?
There is no known exploitation of CVE-2026-117554 in the wild and no public exploit code.
Sources
Also known as GHSA-92g9-59rr-c3qg, GHSA-9v6c-vxr5-xp32.