CVE-2026-117554
4.3 MEDIUMpublic exploit availablePublished 2026-10-27 · Updated 2026-10-27
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-602
Public exploit & PoC references
- https://github.com/Admidio/admidio
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9
- https://github.com/Admidio/admidio/issues/2231
- https://github.com/Admidio/admidio/releases/tag/v5.0.17
- https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg
All references
- https://github.com/Admidio/admidio
- https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462
- https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9
- https://github.com/Admidio/admidio/issues/2231
- https://github.com/Admidio/admidio/releases/tag/v5.0.17
- https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg
- https://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-via-events-function-php
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-100306PoC
- UNSCOREDCVE-2026-110314PoC
- MEDIUMCVE-2026-116605PoC
- HIGHCVE-2026-13138
- MEDIUMCVE-2026-77320PoC
- MEDIUMCVE-2026-89205
- MEDIUMCVE-2026-89206
Related by shared AI tags and CWE weakness class. Browse the full archive.