---
id: CVE-2026-117554
title: Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
summary: >-
  Admidio before 5.0.17 contains an improper access control vulnerability that
  allows authenticated members to register event guests by submitting the
  additional_guests field when guests are disallowed. Attackers can set
  additional_guests …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-602
vendor: admidio
product: admidio
affected:
  - admidio < 5.0.17
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T13:07:50.357Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117554'
references:
  - url: 'https://github.com/Admidio/admidio/issues/2231'
    label: 'GitHub Issue #2231'
  - url: 'https://github.com/Admidio/admidio'
  - url: 'https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qg'
    label: GitHub Security Advisory (GHSA-92g9-59rr-c3qg)
  - url: >-
      https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9
  - url: 'https://github.com/Admidio/admidio/releases/tag/v5.0.17'
    label: admidio v5.0.17 Release Notes
  - url: >-
      https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462
  - url: >-
      https://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-via-events-function-php
    label: >-
      VulnCheck Advisory: Admidio before 5.0.17 Event Guest Restriction Bypass
      via events_function.php
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.330Z'
---

## Overview

Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.

## Affected

- `admidio < 5.0.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.