# CVE-2026-117554: Admidio improper access control in event registration

Source: https://junglewise.ai/threats/cve-2026-117554-admidio-before-5-0-17-contains-an-improper-access-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117554 · Severity: medium · CVSS 4.3 · Published 2026-10-27

Admidio is a membership and event management system for organizations. An authenticated member can bypass event capacity limits by directly submitting a field that adds additional guests, even when guest registration is disabled. This allows attackers to exhaust event capacity and prevent legitimate members from registering.

Technologies: [Admidio](https://junglewise.ai/threats/technologies/admidio). Vendors: [Admidio](https://junglewise.ai/threats/vendors/admidio).

## Quick answers

**Is CVE-2026-117554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117554 being exploited in the wild.

**How severe is CVE-2026-117554?** Medium severity, with a CVSS score of 4.3, published 27 October 2026.

**Which products and versions are affected?** Admidio before 5.0.17.

**Is there a fix for CVE-2026-117554?** Yes: fixed in 5.0.17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117554 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-117554?** Check whether you run Admidio at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.0.17

## Technical details

The vulnerability is an improper access control flaw in the event registration module (modules/events/events_function.php) that fails to validate the additional_guests field when guest registration is disabled. An authenticated attacker can set this field to the remaining seat count, allowing them to register unlimited guests and block other members from registering for the event. A fix is available in version 5.0.17.

## Affected products

- Admidio Admidio before 5.0.17

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/Admidio/admidio](https://github.com/Admidio/admidio)
- [https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php](https://github.com/Admidio/admidio/blob/v5.0.16/modules/events/events_function.php)

## Related threats

- [Admidio information disclosure in RSS weblinks feed](https://junglewise.ai/threats/cve-2026-111916-admidio-before-5-0-16-contains-an-information-disclosure)
- [Admidio broken access control in inventory module](https://junglewise.ai/threats/cve-2026-111914-admidio-from-5-0-11-before-5-0-16-contains-a-broken-access)
- [Admidio authorization bypass via pdfl export mode](https://junglewise.ai/threats/cve-2026-111913-admidio-from-5-0-0-before-5-0-16-contains-an-authorization)
- [Admidio forum topic authorization bypass in ForumService::saveTopic()](https://junglewise.ai/threats/cve-2026-111912-admidio-from-5-0-0-before-5-0-16-contains-an-insecure-direct)
- [Admidio broken access control in role member assignment](https://junglewise.ai/threats/cve-2026-109329-admidio-4-3-2-through-4-3-17-and-5-0-0-before-5-0-15-contains-a)