CVE-2026-117554Medium· 4.3▾ SunlitAdmidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
admidio < 5.0.17Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111914Medium· 6.5Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
CVE-2026-111912Medium· 6.5Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
CVE-2026-111913Medium· 4.3Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
CVE-2026-111916Medium· 5.3Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
CVE-2026-109329Medium· 6.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations
CVE-2026-109327Medium· 6.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomple…