CVE-2026-117554: falha de média gravidade em admidio
Admidio before 5.0.17 Event Guest Restriction Bypass via events_function.php
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register event guests by submitting the additional_guests field when guests are disallowed. Attackers can set additional_guests to the remaining seat count in modules/events/events_function.php to exhaust event capacity and block other members from registering.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
admidio · admidioReferências
https://github.com/Admidio/admidiohttps://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php#L446-L462https://github.com/Admidio/admidio/commit/5b0ee3585d2a69a6e85fee00b7b93f3ebc1e44d9https://github.com/Admidio/admidio/issues/2231https://github.com/Admidio/admidio/releases/tag/v5.0.17https://github.com/Admidio/admidio/security/advisories/GHSA-92g9-59rr-c3qghttps://www.vulncheck.com/advisories/admidio-before-5.0.17-event-guest-restriction-bypass-via-events-function-php